@farm.js/workos 0.1.0-beta.10 → 0.1.0-beta.101

package/dist/index.d.ts

@@ -1,6 +1,9 @@
+import { WorkOS } from "@workos-inc/node";
 import { type FarmIntegrationLogger } from "@farm.js/core";
 import type { WorkOSRedirectResult } from "./client.js";
 export interface WorkOSIntegrationInput {
+    /** Existing WorkOS SDK instance. When provided, Farm does not construct its own client. */
+    instance?: WorkOSIntegrationInstance;
     clientId?: string;
     apiKey?: string;
     cookiePassword?: string;
@@ -11,11 +14,18 @@ export interface WorkOSIntegrationInput {
     logoutPath?: string;
     sessionPath?: string;
     protectedRoutes?: string | string[];
+    /**
+     * Additional origins allowed to post the sign-out route, using the same
+     * pattern syntax as `serverActions.allowedOrigins`. The app's own origin is
+     * always trusted.
+     */
+    allowedOrigins?: string[];
     log?: FarmIntegrationLogger;
 }
+export type WorkOSIntegrationInstance = WorkOS;
 interface ResolvedWorkOSConfig {
     clientId: string;
-    apiKey: string;
+    apiKey?: string;
     cookiePassword: string;
 }
 export declare function workos(input?: WorkOSIntegrationInput): import("@farm.js/core").DefinedIntegration<{

package/dist/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AACA,OAAO,EAAuC,KAAK,qBAAqB,EAAE,MAAM,eAAe,CAAC;AAWhG,OAAO,KAAK,EAAuB,oBAAoB,EAAuB,MAAM,aAAa,CAAC;AAGlG,MAAM,WAAW,sBAAsB;IACrC,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,eAAe,CAAC,EAAE,MAAM,GAAG,MAAM,EAAE,CAAC;IACpC,GAAG,CAAC,EAAE,qBAAqB,CAAC;CAC7B;AAID,UAAU,oBAAoB;IAC5B,QAAQ,EAAE,MAAM,CAAC;IACjB,MAAM,EAAE,MAAM,CAAC;IACf,cAAc,EAAE,MAAM,CAAC;CACxB;AA+ED,wBAAgB,MAAM,CAAC,KAAK,GAAE,sBAA2B;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;mBAkJG,MAAM;;;;yBAoE7B,OAAO;;GAe3C"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,MAAM,EAAE,MAAM,kBAAkB,CAAC;AAC1C,OAAO,EAAuC,KAAK,qBAAqB,EAAE,MAAM,eAAe,CAAC;AAgBhG,OAAO,KAAK,EAAuB,oBAAoB,EAAuB,MAAM,aAAa,CAAC;AAQlG,MAAM,WAAW,sBAAsB;IACrC,2FAA2F;IAC3F,QAAQ,CAAC,EAAE,yBAAyB,CAAC;IACrC,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,eAAe,CAAC,EAAE,MAAM,GAAG,MAAM,EAAE,CAAC;IACpC;;;;OAIG;IACH,cAAc,CAAC,EAAE,MAAM,EAAE,CAAC;IAC1B,GAAG,CAAC,EAAE,qBAAqB,CAAC;CAC7B;AAED,MAAM,MAAM,yBAAyB,GAAG,MAAM,CAAC;AAc/C,UAAU,oBAAoB;IAC5B,QAAQ,EAAE,MAAM,CAAC;IACjB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,cAAc,EAAE,MAAM,CAAC;CACxB;AAqFD,wBAAgB,MAAM,CAAC,KAAK,GAAE,sBAA2B;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;mBAoOG,MAAM;;;;yBAyE7B,OAAO;;GAe3C"}

package/dist/index.js

@@ -1,8 +1,19 @@
+import { createHmac, randomBytes, timingSafeEqual } from "node:crypto";
 import { WorkOS } from "@workos-inc/node";
 import { defineIntegration, integrationRoute } from "@farm.js/core";
+import { describeIntegrationOriginRejection, resolveIntegrationAllowedOrigins, validateIntegrationRequestOrigin, } from "@farm.js/core/integrations";
 import { clearRequestCookie, createPathInferredClientApi, createDocumentNavigationMatchers, createRequestCookie, getCookieValue, getReturnTo, integrationConfig, normalizeMatchers, } from "@farm.js/integration-utils";
 import { workosClient } from "./client.js";
 const DEV_COOKIE_PASSWORD = "farmjs-workos-cookie-password-development-2026";
+// The built server re-evaluates farm.config.ts at runtime to instantiate
+// integrations, and Farm does not force NODE_ENV=production into that process.
+// Treating an absent NODE_ENV as "development" would silently seal production
+// sessions with the public DEV_COOKIE_PASSWORD, so only an explicit dev/test
+// value may use it. `farm dev` runs through Vite, which sets
+// NODE_ENV="development".
+function isExplicitDevelopmentEnv() {
+    return process.env.NODE_ENV === "development" || process.env.NODE_ENV === "test";
+}
 function createWorkOSApi(input) {
     return createPathInferredClientApi({
         path: input.loginPath,
@@ -19,21 +30,23 @@ function createWorkOSApi(input) {
     });
 }
 function resolveEnv(input) {
-    const clientId = input.clientId ?? process.env.WORKOS_CLIENT_ID ?? "";
+    const clientId = input.instance?.clientId ?? input.clientId ?? process.env.WORKOS_CLIENT_ID ?? "";
     const apiKey = input.apiKey ?? process.env.WORKOS_API_KEY ?? "";
     const cookiePassword = input.cookiePassword ??
         process.env.WORKOS_COOKIE_PASSWORD ??
         process.env.FARM_WORKOS_COOKIE_PASSWORD ??
-        (process.env.NODE_ENV === "production" ? "" : DEV_COOKIE_PASSWORD);
-    if (!clientId || !apiKey) {
-        throw new Error("WorkOS integration requires WORKOS_CLIENT_ID and WORKOS_API_KEY.");
+        (isExplicitDevelopmentEnv() ? DEV_COOKIE_PASSWORD : "");
+    if (!clientId || (!input.instance && !apiKey)) {
+        throw new Error("WorkOS integration requires a client ID and either a WorkOS instance or WORKOS_API_KEY.");
     }
     if (!cookiePassword) {
-        throw new Error("WorkOS integration requires WORKOS_COOKIE_PASSWORD in production.");
+        throw new Error("WorkOS integration requires WORKOS_COOKIE_PASSWORD. A development-only fallback is used " +
+            'only when NODE_ENV is "development" or "test"; set WORKOS_COOKIE_PASSWORD to a random ' +
+            "32-byte value in every other environment.");
     }
     return {
         clientId,
-        apiKey,
+        apiKey: apiKey || undefined,
         cookiePassword,
     };
 }
@@ -64,23 +77,89 @@ export function workos(input = {}) {
     const callbackPath = input.callbackPath ?? "/callback";
     const logoutPath = input.logoutPath ?? "/logout";
     const sessionPath = input.sessionPath ?? "/auth/session";
-    const workos = new WorkOS({
-        apiKey,
-        clientId,
-    });
+    const allowedOrigins = resolveIntegrationAllowedOrigins(input.allowedOrigins, "workos.allowedOrigins");
+    const workos = input.instance ??
+        new WorkOS({
+            apiKey,
+            clientId,
+        });
+    // The OAuth `state` must be unguessable and bound to the browser that started
+    // the flow. We keep a random nonce in an HMAC-signed, http-only cookie and
+    // require the callback's state to match it, so an attacker cannot feed a
+    // victim a code/state pair from their own login (login CSRF / code injection).
+    const stateCookieName = "farm_workos_state";
+    function signState(payload) {
+        const encoded = Buffer.from(JSON.stringify(payload), "utf8").toString("base64url");
+        const signature = createHmac("sha256", cookiePassword).update(encoded).digest("hex");
+        return `${encoded}.${signature}`;
+    }
+    function unsignState(signed) {
+        if (!signed)
+            return null;
+        const separator = signed.lastIndexOf(".");
+        if (separator <= 0)
+            return null;
+        const encoded = signed.slice(0, separator);
+        const signature = signed.slice(separator + 1);
+        const expected = createHmac("sha256", cookiePassword).update(encoded).digest("hex");
+        if (signature.length !== expected.length)
+            return null;
+        if (!timingSafeEqual(Buffer.from(signature, "utf8"), Buffer.from(expected, "utf8"))) {
+            return null;
+        }
+        try {
+            const parsed = JSON.parse(Buffer.from(encoded, "base64url").toString("utf8"));
+            if (!parsed || typeof parsed !== "object")
+                return null;
+            const { state, returnTo } = parsed;
+            if (typeof state !== "string" || typeof returnTo !== "string")
+                return null;
+            return { state, returnTo };
+        }
+        catch {
+            return null;
+        }
+    }
+    /**
+     * Reject a sign-out request that did not come from this app. Returns the
+     * response to send, or null when the request may proceed.
+     */
+    function rejectForeignOrigin(request) {
+        const result = validateIntegrationRequestOrigin(request, {
+            allowedOrigins,
+            requireOriginMetadata: request.method === "POST",
+        });
+        if (result.ok) {
+            return null;
+        }
+        const message = describeIntegrationOriginRejection(result.reason);
+        if (request.headers.get("x-farm-integration-client") === "1") {
+            return Response.json({ error: message }, { status: 403 });
+        }
+        return new Response(message, {
+            status: 403,
+            headers: { "content-type": "text/plain; charset=utf-8" },
+        });
+    }
     async function redirectToAuth(request, screenHint) {
         const requestUrl = new URL(request.url);
         const returnTo = getReturnTo(requestUrl.searchParams.get("returnTo"), "/dashboard");
         const callbackUrl = new URL(callbackPath, requestUrl.origin);
+        const state = randomBytes(16).toString("hex");
         const authorizationUrl = workos.userManagement.getAuthorizationUrl({
             provider: "authkit",
             clientId,
             redirectUri: callbackUrl.toString(),
             screenHint,
-            state: JSON.stringify({ returnTo }),
+            state,
         });
+        const headers = new Headers();
+        headers.append("set-cookie", createRequestCookie(stateCookieName, signState({ state, returnTo }), request, {
+            maxAge: 600,
+        }));
         return {
-            redirectTo: authorizationUrl,
+            result: { redirectTo: authorizationUrl },
+            headers,
         };
     }
     return defineIntegration({
@@ -103,7 +182,9 @@ export function workos(input = {}) {
                 apiKey,
                 cookiePassword,
             },
-            required: ["clientId", "apiKey", "cookiePassword"],
+            required: input.instance
+                ? ["clientId", "cookiePassword"]
+                : ["clientId", "apiKey", "cookiePassword"],
         }),
         api: createWorkOSApi({
             loginPath,
@@ -121,21 +202,23 @@ export function workos(input = {}) {
             integrationRoute.get(loginPath, {
                 responseFormat: "json",
                 async handler(request) {
-                    const result = await redirectToAuth(request, "sign-in");
+                    const { result, headers } = await redirectToAuth(request, "sign-in");
                     if (request.headers.get("x-farm-integration-client") === "1") {
-                        return Response.json(result);
+                        return Response.json(result, { headers });
                     }
-                    return Response.redirect(result.redirectTo, 302);
+                    headers.set("location", result.redirectTo);
+                    return new Response(null, { status: 302, headers });
                 },
             }),
             integrationRoute.get(signUpPath, {
                 responseFormat: "json",
                 async handler(request) {
-                    const result = await redirectToAuth(request, "sign-up");
+                    const { result, headers } = await redirectToAuth(request, "sign-up");
                     if (request.headers.get("x-farm-integration-client") === "1") {
-                        return Response.json(result);
+                        return Response.json(result, { headers });
                     }
-                    return Response.redirect(result.redirectTo, 302);
+                    headers.set("location", result.redirectTo);
+                    return new Response(null, { status: 302, headers });
                 },
             }),
             integrationRoute.get(callbackPath, {
@@ -150,6 +233,13 @@ export function workos(input = {}) {
                     if (!code) {
                         return new Response("Missing WorkOS authorization code.", { status: 400 });
                     }
+                    // Bind the callback to the browser that started the flow. Verify before
+                    // the code is exchanged so an injected code is never redeemed.
+                    const statePayload = unsignState(getCookieValue(request.headers, stateCookieName));
+                    const state = requestUrl.searchParams.get("state");
+                    if (!statePayload || !state || statePayload.state !== state) {
+                        return new Response("Invalid WorkOS authentication state.", { status: 400 });
+                    }
                     const authentication = await workos.userManagement.authenticateWithCode({
                         clientId,
                         code,
@@ -161,19 +251,11 @@ export function workos(input = {}) {
                     if (!authentication.sealedSession) {
                         return new Response("WorkOS did not return a sealed session.", { status: 500 });
                     }
-                    let returnTo = "/dashboard";
-                    const rawState = requestUrl.searchParams.get("state");
-                    if (rawState) {
-                        try {
-                            const parsed = JSON.parse(rawState);
-                            returnTo = getReturnTo(parsed.returnTo ?? null, "/dashboard");
-                        }
-                        catch {
-                            returnTo = "/dashboard";
-                        }
-                    }
+                    // Taken from the signed cookie, never from the untrusted query string.
+                    const returnTo = getReturnTo(statePayload.returnTo, "/dashboard");
                     const headers = new Headers();
-                    headers.set("set-cookie", createRequestCookie(cookieName, authentication.sealedSession, request));
+                    headers.append("set-cookie", createRequestCookie(cookieName, authentication.sealedSession, request));
+                    headers.append("set-cookie", clearRequestCookie(stateCookieName, request));
                     headers.set("location", new URL(returnTo, requestUrl.origin).toString());
                     return new Response(null, {
                         status: 302,
@@ -184,6 +266,10 @@ export function workos(input = {}) {
             integrationRoute.post(logoutPath, {
                 responseFormat: "json",
                 async handler(request) {
+                    const rejected = rejectForeignOrigin(request);
+                    if (rejected) {
+                        return rejected;
+                    }
                     const requestUrl = new URL(request.url);
                     const sessionState = await getSession(workos, request, cookieName, cookiePassword);
                     const headers = new Headers();
@@ -243,7 +329,7 @@ export function workos(input = {}) {
                         const requestUrl = new URL(request.url);
                         const loginUrl = new URL(loginPath, request.url);
                         loginUrl.searchParams.set("returnTo", `${requestUrl.pathname}${requestUrl.search}`);
-                        return Response.redirect(loginUrl, 307);
+                        return Response.redirect(loginUrl, 303); // 303 (See Other) mandates a GET on the GET-only login route regardless of the original method (RFC 7231 §6.4.4)
                     },
                 },
             ]

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@farm.js/workos",
-  "version": "0.1.0-beta.10",
+  "version": "0.1.0-beta.101",
   "description": "WorkOS integration for Farm.js",
   "license": "MIT",
   "repository": {
@@ -30,8 +30,8 @@
   },
   "dependencies": {
     "@workos-inc/node": "^8.9.0",
-    "@farm.js/core": "0.1.0-beta.10",
-    "@farm.js/integration-utils": "0.1.0-beta.10"
+    "@farm.js/integration-utils": "0.1.0-beta.101",
+    "@farm.js/core": "0.1.0-beta.101"
   },
   "scripts": {
     "build": "node -e \"require('node:fs').rmSync('dist', { recursive: true, force: true })\" && tsc",