@farm.js/workos 0.1.0-beta.97 → 0.1.0-beta.99

package/dist/index.d.ts

@@ -14,6 +14,12 @@ export interface WorkOSIntegrationInput {
     logoutPath?: string;
     sessionPath?: string;
     protectedRoutes?: string | string[];
+    /**
+     * Additional origins allowed to post the sign-out route, using the same
+     * pattern syntax as `serverActions.allowedOrigins`. The app's own origin is
+     * always trusted.
+     */
+    allowedOrigins?: string[];
     log?: FarmIntegrationLogger;
 }
 export type WorkOSIntegrationInstance = WorkOS;

package/dist/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,EAAE,MAAM,kBAAkB,CAAC;AAC1C,OAAO,EAAuC,KAAK,qBAAqB,EAAE,MAAM,eAAe,CAAC;AAWhG,OAAO,KAAK,EAAuB,oBAAoB,EAAuB,MAAM,aAAa,CAAC;AAGlG,MAAM,WAAW,sBAAsB;IACrC,2FAA2F;IAC3F,QAAQ,CAAC,EAAE,yBAAyB,CAAC;IACrC,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,eAAe,CAAC,EAAE,MAAM,GAAG,MAAM,EAAE,CAAC;IACpC,GAAG,CAAC,EAAE,qBAAqB,CAAC;CAC7B;AAED,MAAM,MAAM,yBAAyB,GAAG,MAAM,CAAC;AAc/C,UAAU,oBAAoB;IAC5B,QAAQ,EAAE,MAAM,CAAC;IACjB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,cAAc,EAAE,MAAM,CAAC;CACxB;AAqFD,wBAAgB,MAAM,CAAC,KAAK,GAAE,sBAA2B;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;mBAsJG,MAAM;;;;yBAoE7B,OAAO;;GAe3C"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,MAAM,EAAE,MAAM,kBAAkB,CAAC;AAC1C,OAAO,EAAuC,KAAK,qBAAqB,EAAE,MAAM,eAAe,CAAC;AAgBhG,OAAO,KAAK,EAAuB,oBAAoB,EAAuB,MAAM,aAAa,CAAC;AAQlG,MAAM,WAAW,sBAAsB;IACrC,2FAA2F;IAC3F,QAAQ,CAAC,EAAE,yBAAyB,CAAC;IACrC,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,eAAe,CAAC,EAAE,MAAM,GAAG,MAAM,EAAE,CAAC;IACpC;;;;OAIG;IACH,cAAc,CAAC,EAAE,MAAM,EAAE,CAAC;IAC1B,GAAG,CAAC,EAAE,qBAAqB,CAAC;CAC7B;AAED,MAAM,MAAM,yBAAyB,GAAG,MAAM,CAAC;AAc/C,UAAU,oBAAoB;IAC5B,QAAQ,EAAE,MAAM,CAAC;IACjB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,cAAc,EAAE,MAAM,CAAC;CACxB;AAqFD,wBAAgB,MAAM,CAAC,KAAK,GAAE,sBAA2B;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;mBAoOG,MAAM;;;;yBAyE7B,OAAO;;GAe3C"}

package/dist/index.js

@@ -1,5 +1,7 @@
+import { createHmac, randomBytes, timingSafeEqual } from "node:crypto";
 import { WorkOS } from "@workos-inc/node";
 import { defineIntegration, integrationRoute } from "@farm.js/core";
+import { describeIntegrationOriginRejection, resolveIntegrationAllowedOrigins, validateIntegrationRequestOrigin, } from "@farm.js/core/integrations";
 import { clearRequestCookie, createPathInferredClientApi, createDocumentNavigationMatchers, createRequestCookie, getCookieValue, getReturnTo, integrationConfig, normalizeMatchers, } from "@farm.js/integration-utils";
 import { workosClient } from "./client.js";
 const DEV_COOKIE_PASSWORD = "farmjs-workos-cookie-password-development-2026";
@@ -75,24 +77,89 @@ export function workos(input = {}) {
     const callbackPath = input.callbackPath ?? "/callback";
     const logoutPath = input.logoutPath ?? "/logout";
     const sessionPath = input.sessionPath ?? "/auth/session";
+    const allowedOrigins = resolveIntegrationAllowedOrigins(input.allowedOrigins, "workos.allowedOrigins");
     const workos = input.instance ??
         new WorkOS({
             apiKey,
             clientId,
         });
+    // The OAuth `state` must be unguessable and bound to the browser that started
+    // the flow. We keep a random nonce in an HMAC-signed, http-only cookie and
+    // require the callback's state to match it, so an attacker cannot feed a
+    // victim a code/state pair from their own login (login CSRF / code injection).
+    const stateCookieName = "farm_workos_state";
+    function signState(payload) {
+        const encoded = Buffer.from(JSON.stringify(payload), "utf8").toString("base64url");
+        const signature = createHmac("sha256", cookiePassword).update(encoded).digest("hex");
+        return `${encoded}.${signature}`;
+    }
+    function unsignState(signed) {
+        if (!signed)
+            return null;
+        const separator = signed.lastIndexOf(".");
+        if (separator <= 0)
+            return null;
+        const encoded = signed.slice(0, separator);
+        const signature = signed.slice(separator + 1);
+        const expected = createHmac("sha256", cookiePassword).update(encoded).digest("hex");
+        if (signature.length !== expected.length)
+            return null;
+        if (!timingSafeEqual(Buffer.from(signature, "utf8"), Buffer.from(expected, "utf8"))) {
+            return null;
+        }
+        try {
+            const parsed = JSON.parse(Buffer.from(encoded, "base64url").toString("utf8"));
+            if (!parsed || typeof parsed !== "object")
+                return null;
+            const { state, returnTo } = parsed;
+            if (typeof state !== "string" || typeof returnTo !== "string")
+                return null;
+            return { state, returnTo };
+        }
+        catch {
+            return null;
+        }
+    }
+    /**
+     * Reject a sign-out request that did not come from this app. Returns the
+     * response to send, or null when the request may proceed.
+     */
+    function rejectForeignOrigin(request) {
+        const result = validateIntegrationRequestOrigin(request, {
+            allowedOrigins,
+            requireOriginMetadata: request.method === "POST",
+        });
+        if (result.ok) {
+            return null;
+        }
+        const message = describeIntegrationOriginRejection(result.reason);
+        if (request.headers.get("x-farm-integration-client") === "1") {
+            return Response.json({ error: message }, { status: 403 });
+        }
+        return new Response(message, {
+            status: 403,
+            headers: { "content-type": "text/plain; charset=utf-8" },
+        });
+    }
     async function redirectToAuth(request, screenHint) {
         const requestUrl = new URL(request.url);
         const returnTo = getReturnTo(requestUrl.searchParams.get("returnTo"), "/dashboard");
         const callbackUrl = new URL(callbackPath, requestUrl.origin);
+        const state = randomBytes(16).toString("hex");
         const authorizationUrl = workos.userManagement.getAuthorizationUrl({
             provider: "authkit",
             clientId,
             redirectUri: callbackUrl.toString(),
             screenHint,
-            state: JSON.stringify({ returnTo }),
+            state,
         });
+        const headers = new Headers();
+        headers.append("set-cookie", createRequestCookie(stateCookieName, signState({ state, returnTo }), request, {
+            maxAge: 600,
+        }));
         return {
-            redirectTo: authorizationUrl,
+            result: { redirectTo: authorizationUrl },
+            headers,
         };
     }
     return defineIntegration({
@@ -135,21 +202,23 @@ export function workos(input = {}) {
             integrationRoute.get(loginPath, {
                 responseFormat: "json",
                 async handler(request) {
-                    const result = await redirectToAuth(request, "sign-in");
+                    const { result, headers } = await redirectToAuth(request, "sign-in");
                     if (request.headers.get("x-farm-integration-client") === "1") {
-                        return Response.json(result);
+                        return Response.json(result, { headers });
                     }
-                    return Response.redirect(result.redirectTo, 302);
+                    headers.set("location", result.redirectTo);
+                    return new Response(null, { status: 302, headers });
                 },
             }),
             integrationRoute.get(signUpPath, {
                 responseFormat: "json",
                 async handler(request) {
-                    const result = await redirectToAuth(request, "sign-up");
+                    const { result, headers } = await redirectToAuth(request, "sign-up");
                     if (request.headers.get("x-farm-integration-client") === "1") {
-                        return Response.json(result);
+                        return Response.json(result, { headers });
                     }
-                    return Response.redirect(result.redirectTo, 302);
+                    headers.set("location", result.redirectTo);
+                    return new Response(null, { status: 302, headers });
                 },
             }),
             integrationRoute.get(callbackPath, {
@@ -164,6 +233,13 @@ export function workos(input = {}) {
                     if (!code) {
                         return new Response("Missing WorkOS authorization code.", { status: 400 });
                     }
+                    // Bind the callback to the browser that started the flow. Verify before
+                    // the code is exchanged so an injected code is never redeemed.
+                    const statePayload = unsignState(getCookieValue(request.headers, stateCookieName));
+                    const state = requestUrl.searchParams.get("state");
+                    if (!statePayload || !state || statePayload.state !== state) {
+                        return new Response("Invalid WorkOS authentication state.", { status: 400 });
+                    }
                     const authentication = await workos.userManagement.authenticateWithCode({
                         clientId,
                         code,
@@ -175,19 +251,11 @@ export function workos(input = {}) {
                     if (!authentication.sealedSession) {
                         return new Response("WorkOS did not return a sealed session.", { status: 500 });
                     }
-                    let returnTo = "/dashboard";
-                    const rawState = requestUrl.searchParams.get("state");
-                    if (rawState) {
-                        try {
-                            const parsed = JSON.parse(rawState);
-                            returnTo = getReturnTo(parsed.returnTo ?? null, "/dashboard");
-                        }
-                        catch {
-                            returnTo = "/dashboard";
-                        }
-                    }
+                    // Taken from the signed cookie, never from the untrusted query string.
+                    const returnTo = getReturnTo(statePayload.returnTo, "/dashboard");
                     const headers = new Headers();
-                    headers.set("set-cookie", createRequestCookie(cookieName, authentication.sealedSession, request));
+                    headers.append("set-cookie", createRequestCookie(cookieName, authentication.sealedSession, request));
+                    headers.append("set-cookie", clearRequestCookie(stateCookieName, request));
                     headers.set("location", new URL(returnTo, requestUrl.origin).toString());
                     return new Response(null, {
                         status: 302,
@@ -198,6 +266,10 @@ export function workos(input = {}) {
             integrationRoute.post(logoutPath, {
                 responseFormat: "json",
                 async handler(request) {
+                    const rejected = rejectForeignOrigin(request);
+                    if (rejected) {
+                        return rejected;
+                    }
                     const requestUrl = new URL(request.url);
                     const sessionState = await getSession(workos, request, cookieName, cookiePassword);
                     const headers = new Headers();

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@farm.js/workos",
-  "version": "0.1.0-beta.97",
+  "version": "0.1.0-beta.99",
   "description": "WorkOS integration for Farm.js",
   "license": "MIT",
   "repository": {
@@ -30,8 +30,8 @@
   },
   "dependencies": {
     "@workos-inc/node": "^8.9.0",
-    "@farm.js/core": "0.1.0-beta.97",
-    "@farm.js/integration-utils": "0.1.0-beta.97"
+    "@farm.js/integration-utils": "0.1.0-beta.99",
+    "@farm.js/core": "0.1.0-beta.99"
   },
   "scripts": {
     "build": "node -e \"require('node:fs').rmSync('dist', { recursive: true, force: true })\" && tsc",