@farm.js/core 0.1.51-beta.3 → 0.1.61

package/dist/chunk-7FVVQEVL.cjs

@@ -1,541 +0,0 @@
-"use strict";Object.defineProperty(exports, "__esModule", {value: true}); function _nullishCoalesce(lhs, rhsFn) { if (lhs != null) { return lhs; } else { return rhsFn(); } } function _optionalChain(ops) { let lastAccessLHS = undefined; let value = ops[0]; let i = 1; while (i < ops.length) { const op = ops[i]; const fn = ops[i + 1]; i += 2; if ((op === 'optionalAccess' || op === 'optionalCall') && value == null) { return undefined; } if (op === 'access' || op === 'optionalAccess') { lastAccessLHS = value; value = fn(value); } else if (op === 'call' || op === 'optionalCall') { value = fn((...args) => value.call(lastAccessLHS, ...args)); lastAccessLHS = undefined; } } return value; }
-
-var _chunkJMYXO572cjs = require('./chunk-JMYXO572.cjs');
-
-
-var _chunkSHIWRBFIcjs = require('./chunk-SHIWRBFI.cjs');
-
-// src/mobile/session.ts
-var FARM_MOBILE_SESSION_PLUGIN = "farm:mobile-session";
-var FARM_MOBILE_SESSION_PATH = "/__farm/mobile/session";
-var FARM_MOBILE_APP_HEADER = "x-farm-mobile";
-var FARM_MOBILE_NONCE_HEADER = "x-farm-mobile-nonce";
-var FARM_MOBILE_DEVICE_COOKIE = "farm_mobile";
-var ACCESS_PREFIX = "fma1";
-var REFRESH_PREFIX = "fmr1";
-var STORAGE_NAMESPACE = "farm-mobile";
-var STATE_KEY = "farm:mobile-session";
-var USED_REFRESH_LIMIT = 8;
-var BROWSER_HEADERS = [
-  "origin",
-  "sec-fetch-site",
-  "sec-fetch-mode",
-  "sec-fetch-dest",
-  "sec-fetch-user"
-];
-var APP_ID = /^[A-Za-z][A-Za-z0-9_]*(?:\.[A-Za-z][A-Za-z0-9_]*)+$/;
-var BASE64URL = /^[A-Za-z0-9_-]+$/;
-var encoder = new TextEncoder();
-var decoder = new TextDecoder();
-function toBase64Url(bytes) {
-  let binary = "";
-  for (const byte of bytes) binary += String.fromCharCode(byte);
-  return btoa(binary).replace(/\+/g, "-").replace(/\//g, "_").replace(/=+$/, "");
-}
-function fromBase64Url(value) {
-  const base64 = value.replace(/-/g, "+").replace(/_/g, "/");
-  const binary = atob(base64 + "=".repeat((4 - base64.length % 4) % 4));
-  const bytes = new Uint8Array(binary.length);
-  for (let index = 0; index < binary.length; index++) bytes[index] = binary.charCodeAt(index);
-  return bytes;
-}
-function randomToken(bytes) {
-  return toBase64Url(globalThis.crypto.getRandomValues(new Uint8Array(bytes)));
-}
-async function sha256(value) {
-  const digest = await globalThis.crypto.subtle.digest("SHA-256", encoder.encode(value));
-  return toBase64Url(new Uint8Array(digest));
-}
-async function aesKey(key) {
-  return globalThis.crypto.subtle.importKey("raw", fromBase64Url(key), "AES-GCM", false, [
-    "encrypt",
-    "decrypt"
-  ]);
-}
-async function sealJar(jar, key, deviceId) {
-  const iv = globalThis.crypto.getRandomValues(new Uint8Array(12));
-  const data = await globalThis.crypto.subtle.encrypt(
-    { name: "AES-GCM", iv, additionalData: encoder.encode(deviceId) },
-    await aesKey(key),
-    encoder.encode(JSON.stringify(jar))
-  );
-  return { iv: toBase64Url(iv), data: toBase64Url(new Uint8Array(data)) };
-}
-async function openJar(sealed, key, deviceId) {
-  try {
-    const data = await globalThis.crypto.subtle.decrypt(
-      { name: "AES-GCM", iv: fromBase64Url(sealed.iv), additionalData: encoder.encode(deviceId) },
-      await aesKey(key),
-      fromBase64Url(sealed.data)
-    );
-    const jar = JSON.parse(decoder.decode(data));
-    if (!jar || typeof jar !== "object" || Array.isArray(jar)) return null;
-    return Object.fromEntries(
-      Object.entries(jar).filter(
-        (entry) => typeof entry[1] === "string"
-      )
-    );
-  } catch (e) {
-    return null;
-  }
-}
-function formatToken(prefix, token) {
-  return `${prefix}.${token.deviceId}.${token.secret}.${token.key}`;
-}
-function parseFarmMobileToken(value, kind) {
-  if (typeof value !== "string" || value.length > 256) return null;
-  const parts = value.split(".");
-  if (parts.length !== 4 || parts[0] !== (kind === "access" ? ACCESS_PREFIX : REFRESH_PREFIX)) {
-    return null;
-  }
-  const [, deviceId, secret, key] = parts;
-  if (deviceId.length !== 22 || secret.length !== 43 || key.length !== 43) return null;
-  if (!BASE64URL.test(deviceId) || !BASE64URL.test(secret) || !BASE64URL.test(key)) return null;
-  return { deviceId, secret, key };
-}
-function readCookies(header) {
-  const cookies = {};
-  for (const part of (_nullishCoalesce(header, () => ( ""))).split(";")) {
-    const separator = part.indexOf("=");
-    if (separator <= 0) continue;
-    const name = part.slice(0, separator).trim();
-    if (!name || name === "__proto__" || name in cookies) continue;
-    cookies[name] = part.slice(separator + 1).trim();
-  }
-  return cookies;
-}
-function cookieHeader(jar) {
-  return Object.entries(jar).map(([name, value]) => `${name}=${value}`).join("; ");
-}
-function readSetCookies(headers, now) {
-  const changes = [];
-  for (const line of headers.getSetCookie()) {
-    const [pair = "", ...attributes] = line.split(";");
-    const separator = pair.indexOf("=");
-    if (separator <= 0) continue;
-    const name = pair.slice(0, separator).trim();
-    if (!name || name === "__proto__") continue;
-    let expired = false;
-    for (const attribute of attributes) {
-      const [rawKey = "", ...rest] = attribute.split("=");
-      const key = rawKey.trim().toLowerCase();
-      const value = rest.join("=").trim();
-      if (key === "max-age" && /^-?\d+$/.test(value)) expired = Number(value) <= 0;
-      if (key === "expires" && !attributes.some((item) => /^\s*max-age=/i.test(item))) {
-        const time = Date.parse(value);
-        if (!Number.isNaN(time) && time <= now) expired = true;
-      }
-    }
-    changes.push([name, expired ? null : pair.slice(separator + 1).trim()]);
-  }
-  return changes;
-}
-function applySetCookies(jar, changes) {
-  const next = { ...jar };
-  for (const [name, value] of changes) {
-    if (name === FARM_MOBILE_DEVICE_COOKIE) continue;
-    if (value === null) delete next[name];
-    else next[name] = value;
-  }
-  return next;
-}
-function json(body, status = 200, headers) {
-  const response = Response.json(body, { status, headers });
-  response.headers.set("cache-control", "no-store");
-  return response;
-}
-function failure(status, error, message) {
-  const response = json({ error, message }, status);
-  if (status === 401) {
-    response.headers.set("www-authenticate", `Bearer error="invalid_token"`);
-  }
-  return response;
-}
-function isFarmMobileNativeRequest(request) {
-  return !BROWSER_HEADERS.some((name) => request.headers.has(name));
-}
-function readAppId(request) {
-  const value = _optionalChain([request, 'access', _ => _.headers, 'access', _2 => _2.get, 'call', _3 => _3(FARM_MOBILE_APP_HEADER), 'optionalAccess', _4 => _4.trim, 'call', _5 => _5()]);
-  return value && value.length <= 255 && APP_ID.test(value) ? value : null;
-}
-function bearer(request) {
-  const header = request.headers.get("authorization");
-  if (!header) return null;
-  const match = /^bearer\s+(\S+)$/i.exec(header.trim());
-  return match ? match[1] : null;
-}
-var SessionReadError = class extends Error {
-  constructor(message, reason) {
-    super(message);
-    this.reason = reason;
-  }
-};
-function createFarmMobileSessionPlugin(options) {
-  const basePath = options.basePath && options.basePath !== "/" ? options.basePath : "";
-  const accessTtl = (_nullishCoalesce(options.accessTokenTtl, () => ( 15 * 60))) * 1e3;
-  const refreshTtl = (_nullishCoalesce(options.refreshTokenTtl, () => ( 30 * 24 * 60 * 60))) * 1e3;
-  const nonceTtl = (_nullishCoalesce(options.nonceTtl, () => ( 60))) * 1e3;
-  const now = _nullishCoalesce(options.now, () => ( Date.now));
-  const store = () => _nullishCoalesce(_optionalChain([options, 'access', _6 => _6.storage, 'optionalCall', _7 => _7()]), () => ( _chunkJMYXO572cjs.getStorage.call(void 0, STORAGE_NAMESPACE)));
-  let warnedNoReader = false;
-  function sessionReader() {
-    for (const integration of Object.values(_nullishCoalesce(options.integrations(), () => ( {})))) {
-      const session = _optionalChain([integration, 'optionalAccess', _8 => _8.session]);
-      if (typeof session === "function") {
-        return (request) => session.call(integration, request);
-      }
-    }
-    return null;
-  }
-  async function readSession(reader, url, cookies) {
-    const header = cookieHeader(cookies);
-    if (!header) return null;
-    let session;
-    try {
-      session = await reader(new Request(url, { headers: { cookie: header } }));
-    } catch (error) {
-      throw new SessionReadError("The auth integration's session() failed", error);
-    }
-    const id = _optionalChain([session, 'optionalAccess', _9 => _9.id]);
-    return typeof id === "string" && id ? session : null;
-  }
-  function noReader() {
-    if (!warnedNoReader) {
-      warnedNoReader = true;
-      console.warn(
-        "[Farm] Mobile session tokens need an auth integration that reads sessions (`session()`): @farm.js/auth (`auth: true`) or @farm.js/better-auth. No configured integration has one, so native screens stay signed out."
-      );
-    }
-    return failure(
-      501,
-      "mobile_session_unavailable",
-      "No auth integration in this app reads sessions for mobile tokens."
-    );
-  }
-  function markerCookie(request, value, maxAge) {
-    const secure = new URL(request.url).protocol === "https:" ? "; Secure" : "";
-    return `${FARM_MOBILE_DEVICE_COOKIE}=${value}; Path=${basePath || "/"}; Max-Age=${maxAge}; HttpOnly; SameSite=Lax${secure}`;
-  }
-  async function loadDevice(deviceId) {
-    const record = await store().getItem(`device:${deviceId}`);
-    return record && record.v === 1 ? record : null;
-  }
-  async function saveDevice(deviceId, record) {
-    await store().setItem(`device:${deviceId}`, record);
-  }
-  async function revokeDevice(deviceId) {
-    await store().removeItem(`device:${deviceId}`);
-  }
-  async function challengeKey(sessionId, appId) {
-    return `challenge:${await sha256(`${sessionId}
-${appId}`)}`;
-  }
-  async function issueTokens(deviceId, key, base, jar) {
-    const access = { deviceId, secret: randomToken(32), key };
-    const refresh2 = { deviceId, secret: randomToken(32), key };
-    const issuedAt = now();
-    const record = {
-      ...base,
-      accessHash: await sha256(access.secret),
-      accessExpiresAt: issuedAt + accessTtl,
-      refreshHash: await sha256(refresh2.secret),
-      refreshExpiresAt: issuedAt + refreshTtl,
-      jar: await sealJar(jar, key, deviceId)
-    };
-    await saveDevice(deviceId, record);
-    return {
-      record,
-      body: {
-        tokenType: "Bearer",
-        accessToken: formatToken(ACCESS_PREFIX, access),
-        refreshToken: formatToken(REFRESH_PREFIX, refresh2),
-        expiresIn: Math.floor(accessTtl / 1e3),
-        refreshExpiresIn: Math.floor(refreshTtl / 1e3)
-      }
-    };
-  }
-  function guardEndpoint(request) {
-    if (request.method !== "POST") {
-      return new Response("Method Not Allowed", {
-        status: 405,
-        headers: { allow: "POST", "cache-control": "no-store" }
-      });
-    }
-    if (!isFarmMobileNativeRequest(request)) {
-      return failure(403, "not_native", "Mobile session endpoints answer the app's shell only.");
-    }
-    const appId = readAppId(request);
-    if (!appId) {
-      return failure(400, "invalid_app", `Send the app's mobile.id in ${FARM_MOBILE_APP_HEADER}.`);
-    }
-    return { appId };
-  }
-  async function challenge(request) {
-    const guard = guardEndpoint(request);
-    if (guard instanceof Response) return guard;
-    const reader = sessionReader();
-    if (!reader) return noReader();
-    const cookies = readCookies(request.headers.get("cookie"));
-    delete cookies[FARM_MOBILE_DEVICE_COOKIE];
-    const session = await readSession(reader, request.url, cookies);
-    if (!session) return failure(401, "signed_out", "Sign in on a web screen first.");
-    const nonce = randomToken(32);
-    await store().setItem(await challengeKey(session.id, guard.appId), {
-      hash: await sha256(nonce),
-      expiresAt: now() + nonceTtl
-    });
-    return json({ nonce, expiresIn: Math.floor(nonceTtl / 1e3) });
-  }
-  async function issue(request) {
-    const guard = guardEndpoint(request);
-    if (guard instanceof Response) return guard;
-    const reader = sessionReader();
-    if (!reader) return noReader();
-    const nonce = _nullishCoalesce(_optionalChain([request, 'access', _10 => _10.headers, 'access', _11 => _11.get, 'call', _12 => _12(FARM_MOBILE_NONCE_HEADER), 'optionalAccess', _13 => _13.trim, 'call', _14 => _14()]), () => ( ""));
-    const cookies = readCookies(request.headers.get("cookie"));
-    delete cookies[FARM_MOBILE_DEVICE_COOKIE];
-    const session = await readSession(reader, request.url, cookies);
-    if (!session) return failure(401, "signed_out", "Sign in on a web screen first.");
-    const key = await challengeKey(session.id, guard.appId);
-    const pending = await store().getItem(key);
-    if (pending) await store().removeItem(key);
-    if (!pending || pending.expiresAt <= now() || !nonce || !_chunkSHIWRBFIcjs.farmSecretsMatch.call(void 0, await sha256(nonce), pending.hash)) {
-      return failure(401, "invalid_nonce", "Request a new challenge and try again.");
-    }
-    const deviceId = randomToken(16);
-    const { body: tokens } = await issueTokens(
-      deviceId,
-      randomToken(32),
-      {
-        v: 1,
-        appId: guard.appId,
-        sessionHash: await sha256(session.id),
-        createdAt: now(),
-        usedRefreshHashes: []
-      },
-      cookies
-    );
-    const response = json(tokens);
-    response.headers.append(
-      "set-cookie",
-      markerCookie(request, deviceId, Math.floor(refreshTtl / 1e3))
-    );
-    return response;
-  }
-  async function refresh(request) {
-    const guard = guardEndpoint(request);
-    if (guard instanceof Response) return guard;
-    const reader = sessionReader();
-    if (!reader) return noReader();
-    const token = parseFarmMobileToken(bearer(request), "refresh");
-    if (!token) return failure(401, "invalid_token", "Unknown refresh token.");
-    const record = await loadDevice(token.deviceId);
-    if (!record) return failure(401, "invalid_token", "Unknown refresh token.");
-    if (record.appId !== guard.appId) {
-      return failure(401, "invalid_token", "The token belongs to another app.");
-    }
-    const hash = await sha256(token.secret);
-    if (!_chunkSHIWRBFIcjs.farmSecretsMatch.call(void 0, hash, record.refreshHash)) {
-      if (record.usedRefreshHashes.some((used) => _chunkSHIWRBFIcjs.farmSecretsMatch.call(void 0, hash, used))) {
-        await revokeDevice(token.deviceId);
-        return failure(401, "refresh_reused", "The refresh token was already used.");
-      }
-      return failure(401, "invalid_token", "Unknown refresh token.");
-    }
-    if (record.refreshExpiresAt <= now()) {
-      await revokeDevice(token.deviceId);
-      return failure(401, "invalid_token", "The refresh token expired.");
-    }
-    const jar = await openJar(record.jar, token.key, token.deviceId);
-    if (!jar) return failure(401, "invalid_token", "Unknown refresh token.");
-    let session;
-    try {
-      session = await readSession(reader, request.url, jar);
-    } catch (error) {
-      console.error("[Farm] Mobile session refresh could not read the session:", error);
-      return failure(503, "session_unavailable", "Try again later.");
-    }
-    if (!session || await sha256(session.id) !== record.sessionHash) {
-      await revokeDevice(token.deviceId);
-      return failure(401, "signed_out", "The web session behind this device ended.");
-    }
-    const { body: tokens } = await issueTokens(
-      token.deviceId,
-      randomToken(32),
-      {
-        v: 1,
-        appId: record.appId,
-        sessionHash: record.sessionHash,
-        createdAt: record.createdAt,
-        usedRefreshHashes: [record.refreshHash, ...record.usedRefreshHashes].slice(
-          0,
-          USED_REFRESH_LIMIT
-        )
-      },
-      jar
-    );
-    const response = json(tokens);
-    response.headers.append(
-      "set-cookie",
-      markerCookie(request, token.deviceId, Math.floor(refreshTtl / 1e3))
-    );
-    return response;
-  }
-  async function revoke(request) {
-    const guard = guardEndpoint(request);
-    if (guard instanceof Response) return guard;
-    const access = parseFarmMobileToken(bearer(request), "access");
-    const token = _nullishCoalesce(access, () => ( parseFarmMobileToken(bearer(request), "refresh")));
-    if (token) {
-      const record = await loadDevice(token.deviceId);
-      const hash = await sha256(token.secret);
-      if (record && record.appId === guard.appId && _chunkSHIWRBFIcjs.farmSecretsMatch.call(void 0, hash, access ? record.accessHash : record.refreshHash)) {
-        await revokeDevice(token.deviceId);
-      }
-    }
-    const response = new Response(null, { status: 204, headers: { "cache-control": "no-store" } });
-    response.headers.append("set-cookie", markerCookie(request, "", 0));
-    return response;
-  }
-  async function before(event) {
-    const { request } = event;
-    const value = bearer(request);
-    if (!_optionalChain([value, 'optionalAccess', _15 => _15.startsWith, 'call', _16 => _16(`${ACCESS_PREFIX}.`)])) return void 0;
-    if (!isFarmMobileNativeRequest(request)) return void 0;
-    const token = parseFarmMobileToken(value, "access");
-    if (!token) return failure(401, "invalid_token", "Unknown access token.");
-    const appId = readAppId(request);
-    const record = await loadDevice(token.deviceId);
-    const hash = await sha256(token.secret);
-    if (!record || !_chunkSHIWRBFIcjs.farmSecretsMatch.call(void 0, hash, record.accessHash)) {
-      return failure(401, "invalid_token", "Unknown access token.");
-    }
-    if (!appId || appId !== record.appId) {
-      return failure(401, "invalid_token", "The token belongs to another app.");
-    }
-    if (record.accessExpiresAt <= now()) {
-      return failure(401, "invalid_token", "The access token expired.");
-    }
-    const jar = await openJar(record.jar, token.key, token.deviceId);
-    if (!jar) return failure(401, "invalid_token", "Unknown access token.");
-    const headers = new Headers(request.headers);
-    headers.delete("authorization");
-    headers.delete("cookie");
-    const cookies = cookieHeader(jar);
-    if (cookies) headers.set("cookie", cookies);
-    headers.set("origin", new URL(request.url).origin);
-    event.req.set(STATE_KEY, {
-      deviceId: token.deviceId,
-      key: token.key,
-      accessHash: record.accessHash
-    });
-    return new Request(request, { headers });
-  }
-  async function after(event) {
-    const state = event.req.get(STATE_KEY);
-    if (state) return afterBearer(event.request, event.response, state);
-    const cookie = event.request.headers.get("cookie");
-    if (!_optionalChain([cookie, 'optionalAccess', _17 => _17.includes, 'call', _18 => _18(`${FARM_MOBILE_DEVICE_COOKIE}=`)])) return void 0;
-    return afterWebScreen(event.request, event.response);
-  }
-  async function afterBearer(request, response, state) {
-    const changes = readSetCookies(response.headers, now());
-    const headers = new Headers(response.headers);
-    headers.delete("set-cookie");
-    headers.set("cache-control", "private, no-store");
-    if (changes.length > 0) {
-      const record = await loadDevice(state.deviceId);
-      if (record && _chunkSHIWRBFIcjs.farmSecretsMatch.call(void 0, state.accessHash, record.accessHash)) {
-        const jar = await openJar(record.jar, state.key, state.deviceId);
-        if (jar) {
-          const next = applySetCookies(jar, changes);
-          const reader = sessionReader();
-          let signedOut = false;
-          if (reader && changes.some(([, value]) => value === null)) {
-            signedOut = await readSession(reader, request.url, next).then(
-              async (session) => !session || await sha256(session.id) !== record.sessionHash,
-              () => false
-            );
-          }
-          if (signedOut) await revokeDevice(state.deviceId);
-          else
-            await saveDevice(state.deviceId, {
-              ...record,
-              jar: await sealJar(next, state.key, state.deviceId)
-            });
-        }
-      }
-    }
-    return new Response(response.body, {
-      status: response.status,
-      statusText: response.statusText,
-      headers
-    });
-  }
-  async function afterWebScreen(request, response) {
-    const changes = readSetCookies(response.headers, now());
-    if (!changes.some(([, value]) => value === null)) return void 0;
-    const cookies = readCookies(request.headers.get("cookie"));
-    const deviceId = cookies[FARM_MOBILE_DEVICE_COOKIE];
-    if (!deviceId || deviceId.length !== 22 || !BASE64URL.test(deviceId)) return void 0;
-    const reader = sessionReader();
-    if (!reader) return void 0;
-    delete cookies[FARM_MOBILE_DEVICE_COOKIE];
-    const signedOut = await readSession(
-      reader,
-      request.url,
-      applySetCookies(cookies, changes)
-    ).then(
-      (session) => !session,
-      () => false
-    );
-    if (!signedOut) return void 0;
-    await revokeDevice(deviceId);
-    const headers = new Headers(response.headers);
-    headers.append("set-cookie", markerCookie(request, "", 0));
-    return new Response(response.body, {
-      status: response.status,
-      statusText: response.statusText,
-      headers
-    });
-  }
-  const endpoint = (path, handler) => ({
-    path,
-    handler: (event) => handler(event.request).catch((error) => {
-      if (error instanceof SessionReadError) {
-        console.error("[Farm] Mobile session endpoint could not read the session:", error.reason);
-        return failure(503, "session_unavailable", "Try again later.");
-      }
-      throw error;
-    })
-  });
-  return {
-    name: FARM_MOBILE_SESSION_PLUGIN,
-    // Before app plugins, so their hooks see the signed-in request.
-    enforce: "pre",
-    runtime: {
-      // `before` changes only requests with a mobile bearer, and `after` marks those private.
-      // Every other response stays as cacheable as it was.
-      cache: "public",
-      endpoints: [
-        endpoint(`${FARM_MOBILE_SESSION_PATH}/challenge`, challenge),
-        endpoint(FARM_MOBILE_SESSION_PATH, issue),
-        endpoint(`${FARM_MOBILE_SESSION_PATH}/refresh`, refresh),
-        endpoint(`${FARM_MOBILE_SESSION_PATH}/revoke`, revoke)
-      ],
-      before,
-      after
-    }
-  };
-}
-
-
-
-
-
-
-
-
-
-
-exports.FARM_MOBILE_SESSION_PLUGIN = FARM_MOBILE_SESSION_PLUGIN; exports.FARM_MOBILE_SESSION_PATH = FARM_MOBILE_SESSION_PATH; exports.FARM_MOBILE_APP_HEADER = FARM_MOBILE_APP_HEADER; exports.FARM_MOBILE_NONCE_HEADER = FARM_MOBILE_NONCE_HEADER; exports.FARM_MOBILE_DEVICE_COOKIE = FARM_MOBILE_DEVICE_COOKIE; exports.parseFarmMobileToken = parseFarmMobileToken; exports.isFarmMobileNativeRequest = isFarmMobileNativeRequest; exports.createFarmMobileSessionPlugin = createFarmMobileSessionPlugin;