@farm.js/workos 0.1.0-beta.96 → 0.1.0-beta.98

package/dist/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,EAAE,MAAM,kBAAkB,CAAC;AAC1C,OAAO,EAAuC,KAAK,qBAAqB,EAAE,MAAM,eAAe,CAAC;AAWhG,OAAO,KAAK,EAAuB,oBAAoB,EAAuB,MAAM,aAAa,CAAC;AAGlG,MAAM,WAAW,sBAAsB;IACrC,2FAA2F;IAC3F,QAAQ,CAAC,EAAE,yBAAyB,CAAC;IACrC,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,eAAe,CAAC,EAAE,MAAM,GAAG,MAAM,EAAE,CAAC;IACpC,GAAG,CAAC,EAAE,qBAAqB,CAAC;CAC7B;AAED,MAAM,MAAM,yBAAyB,GAAG,MAAM,CAAC;AAI/C,UAAU,oBAAoB;IAC5B,QAAQ,EAAE,MAAM,CAAC;IACjB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,cAAc,EAAE,MAAM,CAAC;CACxB;AAiFD,wBAAgB,MAAM,CAAC,KAAK,GAAE,sBAA2B;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;mBAsJG,MAAM;;;;yBAoE7B,OAAO;;GAe3C"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,MAAM,EAAE,MAAM,kBAAkB,CAAC;AAC1C,OAAO,EAAuC,KAAK,qBAAqB,EAAE,MAAM,eAAe,CAAC;AAWhG,OAAO,KAAK,EAAuB,oBAAoB,EAAuB,MAAM,aAAa,CAAC;AAQlG,MAAM,WAAW,sBAAsB;IACrC,2FAA2F;IAC3F,QAAQ,CAAC,EAAE,yBAAyB,CAAC;IACrC,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,eAAe,CAAC,EAAE,MAAM,GAAG,MAAM,EAAE,CAAC;IACpC,GAAG,CAAC,EAAE,qBAAqB,CAAC;CAC7B;AAED,MAAM,MAAM,yBAAyB,GAAG,MAAM,CAAC;AAc/C,UAAU,oBAAoB;IAC5B,QAAQ,EAAE,MAAM,CAAC;IACjB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,cAAc,EAAE,MAAM,CAAC;CACxB;AAqFD,wBAAgB,MAAM,CAAC,KAAK,GAAE,sBAA2B;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;mBAqMG,MAAM;;;;yBAoE7B,OAAO;;GAe3C"}

package/dist/index.js

@@ -1,8 +1,18 @@
+import { createHmac, randomBytes, timingSafeEqual } from "node:crypto";
 import { WorkOS } from "@workos-inc/node";
 import { defineIntegration, integrationRoute } from "@farm.js/core";
 import { clearRequestCookie, createPathInferredClientApi, createDocumentNavigationMatchers, createRequestCookie, getCookieValue, getReturnTo, integrationConfig, normalizeMatchers, } from "@farm.js/integration-utils";
 import { workosClient } from "./client.js";
 const DEV_COOKIE_PASSWORD = "farmjs-workos-cookie-password-development-2026";
+// The built server re-evaluates farm.config.ts at runtime to instantiate
+// integrations, and Farm does not force NODE_ENV=production into that process.
+// Treating an absent NODE_ENV as "development" would silently seal production
+// sessions with the public DEV_COOKIE_PASSWORD, so only an explicit dev/test
+// value may use it. `farm dev` runs through Vite, which sets
+// NODE_ENV="development".
+function isExplicitDevelopmentEnv() {
+    return process.env.NODE_ENV === "development" || process.env.NODE_ENV === "test";
+}
 function createWorkOSApi(input) {
     return createPathInferredClientApi({
         path: input.loginPath,
@@ -24,12 +34,14 @@ function resolveEnv(input) {
     const cookiePassword = input.cookiePassword ??
         process.env.WORKOS_COOKIE_PASSWORD ??
         process.env.FARM_WORKOS_COOKIE_PASSWORD ??
-        (process.env.NODE_ENV === "production" ? "" : DEV_COOKIE_PASSWORD);
+        (isExplicitDevelopmentEnv() ? DEV_COOKIE_PASSWORD : "");
     if (!clientId || (!input.instance && !apiKey)) {
         throw new Error("WorkOS integration requires a client ID and either a WorkOS instance or WORKOS_API_KEY.");
     }
     if (!cookiePassword) {
-        throw new Error("WorkOS integration requires WORKOS_COOKIE_PASSWORD in production.");
+        throw new Error("WorkOS integration requires WORKOS_COOKIE_PASSWORD. A development-only fallback is used " +
+            'only when NODE_ENV is "development" or "test"; set WORKOS_COOKIE_PASSWORD to a random ' +
+            "32-byte value in every other environment.");
     }
     return {
         clientId,
@@ -69,19 +81,62 @@ export function workos(input = {}) {
             apiKey,
             clientId,
         });
+    // The OAuth `state` must be unguessable and bound to the browser that started
+    // the flow. We keep a random nonce in an HMAC-signed, http-only cookie and
+    // require the callback's state to match it, so an attacker cannot feed a
+    // victim a code/state pair from their own login (login CSRF / code injection).
+    const stateCookieName = "farm_workos_state";
+    function signState(payload) {
+        const encoded = Buffer.from(JSON.stringify(payload), "utf8").toString("base64url");
+        const signature = createHmac("sha256", cookiePassword).update(encoded).digest("hex");
+        return `${encoded}.${signature}`;
+    }
+    function unsignState(signed) {
+        if (!signed)
+            return null;
+        const separator = signed.lastIndexOf(".");
+        if (separator <= 0)
+            return null;
+        const encoded = signed.slice(0, separator);
+        const signature = signed.slice(separator + 1);
+        const expected = createHmac("sha256", cookiePassword).update(encoded).digest("hex");
+        if (signature.length !== expected.length)
+            return null;
+        if (!timingSafeEqual(Buffer.from(signature, "utf8"), Buffer.from(expected, "utf8"))) {
+            return null;
+        }
+        try {
+            const parsed = JSON.parse(Buffer.from(encoded, "base64url").toString("utf8"));
+            if (!parsed || typeof parsed !== "object")
+                return null;
+            const { state, returnTo } = parsed;
+            if (typeof state !== "string" || typeof returnTo !== "string")
+                return null;
+            return { state, returnTo };
+        }
+        catch {
+            return null;
+        }
+    }
     async function redirectToAuth(request, screenHint) {
         const requestUrl = new URL(request.url);
         const returnTo = getReturnTo(requestUrl.searchParams.get("returnTo"), "/dashboard");
         const callbackUrl = new URL(callbackPath, requestUrl.origin);
+        const state = randomBytes(16).toString("hex");
         const authorizationUrl = workos.userManagement.getAuthorizationUrl({
             provider: "authkit",
             clientId,
             redirectUri: callbackUrl.toString(),
             screenHint,
-            state: JSON.stringify({ returnTo }),
+            state,
         });
+        const headers = new Headers();
+        headers.append("set-cookie", createRequestCookie(stateCookieName, signState({ state, returnTo }), request, {
+            maxAge: 600,
+        }));
         return {
-            redirectTo: authorizationUrl,
+            result: { redirectTo: authorizationUrl },
+            headers,
         };
     }
     return defineIntegration({
@@ -124,21 +179,23 @@ export function workos(input = {}) {
             integrationRoute.get(loginPath, {
                 responseFormat: "json",
                 async handler(request) {
-                    const result = await redirectToAuth(request, "sign-in");
+                    const { result, headers } = await redirectToAuth(request, "sign-in");
                     if (request.headers.get("x-farm-integration-client") === "1") {
-                        return Response.json(result);
+                        return Response.json(result, { headers });
                     }
-                    return Response.redirect(result.redirectTo, 302);
+                    headers.set("location", result.redirectTo);
+                    return new Response(null, { status: 302, headers });
                 },
             }),
             integrationRoute.get(signUpPath, {
                 responseFormat: "json",
                 async handler(request) {
-                    const result = await redirectToAuth(request, "sign-up");
+                    const { result, headers } = await redirectToAuth(request, "sign-up");
                     if (request.headers.get("x-farm-integration-client") === "1") {
-                        return Response.json(result);
+                        return Response.json(result, { headers });
                     }
-                    return Response.redirect(result.redirectTo, 302);
+                    headers.set("location", result.redirectTo);
+                    return new Response(null, { status: 302, headers });
                 },
             }),
             integrationRoute.get(callbackPath, {
@@ -153,6 +210,13 @@ export function workos(input = {}) {
                     if (!code) {
                         return new Response("Missing WorkOS authorization code.", { status: 400 });
                     }
+                    // Bind the callback to the browser that started the flow. Verify before
+                    // the code is exchanged so an injected code is never redeemed.
+                    const statePayload = unsignState(getCookieValue(request.headers, stateCookieName));
+                    const state = requestUrl.searchParams.get("state");
+                    if (!statePayload || !state || statePayload.state !== state) {
+                        return new Response("Invalid WorkOS authentication state.", { status: 400 });
+                    }
                     const authentication = await workos.userManagement.authenticateWithCode({
                         clientId,
                         code,
@@ -164,19 +228,11 @@ export function workos(input = {}) {
                     if (!authentication.sealedSession) {
                         return new Response("WorkOS did not return a sealed session.", { status: 500 });
                     }
-                    let returnTo = "/dashboard";
-                    const rawState = requestUrl.searchParams.get("state");
-                    if (rawState) {
-                        try {
-                            const parsed = JSON.parse(rawState);
-                            returnTo = getReturnTo(parsed.returnTo ?? null, "/dashboard");
-                        }
-                        catch {
-                            returnTo = "/dashboard";
-                        }
-                    }
+                    // Taken from the signed cookie, never from the untrusted query string.
+                    const returnTo = getReturnTo(statePayload.returnTo, "/dashboard");
                     const headers = new Headers();
-                    headers.set("set-cookie", createRequestCookie(cookieName, authentication.sealedSession, request));
+                    headers.append("set-cookie", createRequestCookie(cookieName, authentication.sealedSession, request));
+                    headers.append("set-cookie", clearRequestCookie(stateCookieName, request));
                     headers.set("location", new URL(returnTo, requestUrl.origin).toString());
                     return new Response(null, {
                         status: 302,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@farm.js/workos",
-  "version": "0.1.0-beta.96",
+  "version": "0.1.0-beta.98",
   "description": "WorkOS integration for Farm.js",
   "license": "MIT",
   "repository": {
@@ -30,8 +30,8 @@
   },
   "dependencies": {
     "@workos-inc/node": "^8.9.0",
-    "@farm.js/integration-utils": "0.1.0-beta.96",
-    "@farm.js/core": "0.1.0-beta.96"
+    "@farm.js/core": "0.1.0-beta.98",
+    "@farm.js/integration-utils": "0.1.0-beta.98"
   },
   "scripts": {
     "build": "node -e \"require('node:fs').rmSync('dist', { recursive: true, force: true })\" && tsc",