@finueva/auth 0.8.1 → 0.10.0

package/dist/server.js

@@ -181,6 +181,7 @@ const messages = {
 	password_reset_invalid: "The password reset request is invalid.",
 	authentication_required: "Authentication is required.",
 	request_origin_denied: "The request origin is not allowed.",
+	invalid_request: "The request is invalid.",
 	invalid_invitation: "The invitation is invalid.",
 	invitation_unavailable: "The invitation is not available.",
 	invitation_recipient_mismatch: "The invitation cannot be accepted by this account.",
@@ -474,6 +475,12 @@ const DRIVE_CREDENTIAL_LIFETIME_SECONDS = 840;
 const id = /^[A-Za-z0-9_-]{1,128}$/;
 const email = /^[^\s@]+@[^\s@]+$/;
 const MAX_SOCIAL_ID_TOKEN_BYTES = 16 * 1024;
+function normalizeEmail(value) {
+	if (typeof value !== "string") throw new TypeError("email is invalid");
+	const normalized = value.trim().toLowerCase();
+	if (normalized.length === 0 || normalized.length > 320 || !email.test(normalized)) throw new TypeError("email is invalid");
+	return normalized;
+}
 function normalizeSocialIdTokenInput(value) {
 	if (!isObject(value)) throw new TypeError("social ID token input is invalid");
 	const keys = Object.keys(value);
@@ -538,18 +545,283 @@ function normalizeDriveCredential(value, now) {
 		expiresAt: new Date(now + value.expiresIn * 1e3)
 	};
 }
+function normalizeOrganizationPageInput(value) {
+	if (value === void 0) return new URLSearchParams();
+	if (!isObject(value) || Object.keys(value).some((key) => key !== "limit" && key !== "cursor")) throw new AuthError("invalid_request", 400);
+	const input = value;
+	const query = new URLSearchParams();
+	if (input.limit !== void 0) {
+		if (!Number.isSafeInteger(input.limit) || input.limit < 1 || input.limit > 100) throw new AuthError("invalid_request", 400);
+		query.set("limit", String(input.limit));
+	}
+	if (input.cursor !== void 0) {
+		if (typeof input.cursor !== "string" || input.cursor.length < 1 || input.cursor.length > 820 || !/^[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+$/.test(input.cursor)) throw new AuthError("invalid_request", 400);
+		query.set("cursor", input.cursor);
+	}
+	return query;
+}
+function normalizeIdInput(value) {
+	if (!isId(value)) throw new AuthError("invalid_request", 400);
+	return value;
+}
+function normalizeOrganization(value) {
+	exact(value, [
+		"capabilities",
+		"id",
+		"lifecycle",
+		"logo",
+		"name",
+		"role",
+		"slug"
+	]);
+	if (!isId(value.id) || !boundedString(value.name, 255) || !boundedString(value.slug, 255) || value.lifecycle !== "ordinary" && value.lifecycle !== "managed" || !role(value.role) || !isObject(value.capabilities)) throw authorityUnavailable();
+	exact(value.capabilities, [
+		"readInvitations",
+		"readMembers",
+		"readTeams"
+	]);
+	if (value.capabilities.readMembers !== true || value.capabilities.readTeams !== true || typeof value.capabilities.readInvitations !== "boolean") throw authorityUnavailable();
+	return {
+		id: value.id,
+		name: value.name,
+		slug: value.slug,
+		logo: nullableHttpsUrl(value.logo),
+		lifecycle: value.lifecycle,
+		role: value.role,
+		capabilities: {
+			readMembers: true,
+			readTeams: true,
+			readInvitations: value.capabilities.readInvitations
+		}
+	};
+}
+function normalizeOrganizationDisplayInput(value) {
+	if (!isObject(value) || Object.keys(value).sort().join(",") !== "logo,name,slug") throw new AuthError("invalid_request", 400);
+	if (!boundedString(value.name, 255) || !boundedString(value.slug, 255)) throw new AuthError("invalid_request", 400);
+	let logo;
+	try {
+		logo = nullableHttpsUrl(value.logo);
+	} catch {
+		throw new AuthError("invalid_request", 400);
+	}
+	return {
+		name: value.name,
+		slug: value.slug,
+		logo
+	};
+}
+function normalizeOrganizationDisplay(value) {
+	try {
+		return normalizeOrganizationDisplayInput(value);
+	} catch {
+		throw authorityUnavailable();
+	}
+}
+function normalizeOrganizationTeamDisplayInput(value) {
+	if (!isObject(value) || Object.keys(value).join(",") !== "name" || !boundedString(value.name, 255)) throw new AuthError("invalid_request", 400);
+	return { name: value.name };
+}
+function normalizeOrganizationTeamDisplay(value) {
+	try {
+		return normalizeOrganizationTeamDisplayInput(value);
+	} catch {
+		throw authorityUnavailable();
+	}
+}
+function normalizeOrganizationTeamCreationInput(name, idempotencyKey) {
+	if (!boundedString(name, 255) || !boundedString(idempotencyKey, 255)) throw new AuthError("invalid_request", 400);
+	return {
+		name,
+		idempotencyKey
+	};
+}
+function normalizeCreatedOrganizationTeam(value) {
+	exact(value, ["id", "name"]);
+	if (!isId(value.id) || !boundedString(value.name, 255)) throw authorityUnavailable();
+	return {
+		id: value.id,
+		name: value.name
+	};
+}
+function normalizeOrganizationMemberInvitationCreationInput(value) {
+	if (!isObject(value)) throw new AuthError("invalid_request", 400);
+	const keys = Object.keys(value).sort().join(",");
+	if (keys !== "email,idempotencyKey" && keys !== "email,idempotencyKey,teamIds") throw new AuthError("invalid_request", 400);
+	let normalizedEmail;
+	try {
+		normalizedEmail = normalizeEmail(value.email);
+	} catch {
+		throw new AuthError("invalid_request", 400);
+	}
+	if (new TextEncoder().encode(normalizedEmail).byteLength > 320 || !boundedString(value.idempotencyKey, 255) || value.teamIds !== void 0 && (!Array.isArray(value.teamIds) || value.teamIds.length > 100)) throw new AuthError("invalid_request", 400);
+	const teamIds = value.teamIds?.map((teamId) => normalizeIdInput(teamId));
+	if (teamIds && new Set(teamIds).size !== teamIds.length) throw new AuthError("invalid_request", 400);
+	return {
+		email: normalizedEmail,
+		...teamIds === void 0 ? {} : { teamIds },
+		idempotencyKey: value.idempotencyKey
+	};
+}
+function normalizeCreatedOrganizationMemberInvitation(value) {
+	exact(value, ["expiresAt", "id"]);
+	if (!isId(value.id)) throw authorityUnavailable();
+	return {
+		id: value.id,
+		expiresAt: responseDate(value.expiresAt)
+	};
+}
 function normalizeOrganizations(value) {
-	if (!Array.isArray(value) || value.length >= 100) throw authorityUnavailable();
-	const seen = new Set();
-	return value.map((organization) => {
-		if (!isObject(organization) || !isId(organization.id) || seen.has(organization.id) || typeof organization.name !== "string" || organization.name.length < 1 || typeof organization.slug !== "string" || organization.slug.length < 1) throw authorityUnavailable();
-		seen.add(organization.id);
-		return {
-			id: organization.id,
-			name: organization.name,
-			slug: organization.slug
-		};
-	});
+	exact(value, ["nextCursor", "organizations"]);
+	if (!Array.isArray(value.organizations) || value.organizations.length > 100) throw authorityUnavailable();
+	return {
+		organizations: unique(value.organizations.map(normalizeOrganization), (item) => item.id),
+		nextCursor: nullableCursor(value.nextCursor)
+	};
+}
+function normalizeOrganizationMembers(value) {
+	exact(value, ["members", "nextCursor"]);
+	if (!Array.isArray(value.members) || value.members.length > 100) throw authorityUnavailable();
+	return {
+		members: unique(value.members.map((member) => {
+			exact(member, [
+				"email",
+				"id",
+				"image",
+				"joinedAt",
+				"name",
+				"owner",
+				"role",
+				"teamIds",
+				"userId"
+			]);
+			if (!isId(member.id) || !isId(member.userId) || !boundedString(member.name, 255) || typeof member.email !== "string" || member.email.length > 320 || !email.test(member.email) || !role(member.role) || typeof member.owner !== "boolean" || !Array.isArray(member.teamIds) || member.teamIds.length > 100) throw authorityUnavailable();
+			const teamIds = unique(member.teamIds.map((teamId) => normalizeResponseId(teamId)), (item) => item);
+			return {
+				id: member.id,
+				userId: member.userId,
+				name: member.name,
+				email: member.email,
+				image: nullableHttpsUrl(member.image),
+				role: member.role,
+				owner: member.owner,
+				joinedAt: responseDate(member.joinedAt),
+				teamIds
+			};
+		}), (item) => item.id),
+		nextCursor: nullableCursor(value.nextCursor)
+	};
+}
+function normalizeOrganizationTeams(value) {
+	exact(value, ["nextCursor", "teams"]);
+	if (!Array.isArray(value.teams) || value.teams.length > 100) throw authorityUnavailable();
+	return {
+		teams: unique(value.teams.map((team) => {
+			exact(team, [
+				"category",
+				"createdAt",
+				"id",
+				"name"
+			]);
+			if (!isId(team.id) || !boundedString(team.name, 255) || team.category !== "manual" && team.category !== "managed") throw authorityUnavailable();
+			return {
+				id: team.id,
+				name: team.name,
+				category: team.category,
+				createdAt: responseDate(team.createdAt)
+			};
+		}), (item) => item.id),
+		nextCursor: nullableCursor(value.nextCursor)
+	};
+}
+function normalizeOrganizationTeamMembers(value) {
+	exact(value, ["memberIds", "nextCursor"]);
+	if (!Array.isArray(value.memberIds) || value.memberIds.length > 100) throw authorityUnavailable();
+	return {
+		memberIds: unique(value.memberIds.map((item) => normalizeResponseId(item)), (item) => item),
+		nextCursor: nullableCursor(value.nextCursor)
+	};
+}
+function normalizeOrganizationInvitation(value) {
+	exact(value, [
+		"createdAt",
+		"email",
+		"expiresAt",
+		"id",
+		"inviter",
+		"role",
+		"status",
+		"teamIds"
+	]);
+	if (!isId(value.id) || typeof value.email !== "string" || value.email.length > 320 || !email.test(value.email) || !role(value.role) || value.status !== "pending" || !Array.isArray(value.teamIds) || value.teamIds.length > 100 || !isObject(value.inviter)) throw authorityUnavailable();
+	exact(value.inviter, ["membershipId", "name"]);
+	if (!isId(value.inviter.membershipId) || !boundedString(value.inviter.name, 255)) throw authorityUnavailable();
+	return {
+		id: value.id,
+		email: value.email,
+		role: value.role,
+		teamIds: unique(value.teamIds.map(normalizeResponseId), (item) => item),
+		inviter: {
+			membershipId: value.inviter.membershipId,
+			name: value.inviter.name
+		},
+		createdAt: responseDate(value.createdAt),
+		expiresAt: responseDate(value.expiresAt),
+		status: "pending"
+	};
+}
+function normalizeOrganizationInvitations(value) {
+	exact(value, ["invitations", "nextCursor"]);
+	if (!Array.isArray(value.invitations) || value.invitations.length > 100) throw authorityUnavailable();
+	return {
+		invitations: unique(value.invitations.map(normalizeOrganizationInvitation), (item) => item.id),
+		nextCursor: nullableCursor(value.nextCursor)
+	};
+}
+function normalizeReceivedInvitation(value) {
+	exact(value, [
+		"expiresAt",
+		"id",
+		"inviterName",
+		"organization",
+		"role",
+		"teams"
+	]);
+	if (!isId(value.id) || !boundedString(value.inviterName, 255) || !role(value.role) || !Array.isArray(value.teams) || value.teams.length > 100 || !isObject(value.organization)) throw authorityUnavailable();
+	exact(value.organization, [
+		"id",
+		"logo",
+		"name",
+		"slug"
+	]);
+	if (!isId(value.organization.id) || !boundedString(value.organization.name, 255) || !boundedString(value.organization.slug, 255)) throw authorityUnavailable();
+	return {
+		id: value.id,
+		organization: {
+			id: value.organization.id,
+			name: value.organization.name,
+			slug: value.organization.slug,
+			logo: nullableHttpsUrl(value.organization.logo)
+		},
+		role: value.role,
+		teams: unique(value.teams.map((team) => {
+			exact(team, ["id", "name"]);
+			if (!isId(team.id) || !boundedString(team.name, 255)) throw authorityUnavailable();
+			return {
+				id: team.id,
+				name: team.name
+			};
+		}), (item) => item.id),
+		inviterName: value.inviterName,
+		expiresAt: responseDate(value.expiresAt)
+	};
+}
+function normalizeReceivedInvitations(value) {
+	exact(value, ["invitations", "nextCursor"]);
+	if (!Array.isArray(value.invitations) || value.invitations.length > 100) throw authorityUnavailable();
+	return {
+		invitations: unique(value.invitations.map(normalizeReceivedInvitation), (item) => item.id),
+		nextCursor: nullableCursor(value.nextCursor)
+	};
 }
 function normalizeInvitationInput(value) {
 	if (!isObject(value) || Object.keys(value).length !== 1 || !isId(value.invitationId)) throw new AuthError("invalid_invitation", 422);
@@ -601,6 +873,20 @@ function fromOrganizationListError(error) {
 	if (error instanceof AuthError) return error;
 	return authorityUnavailable();
 }
+function fromOrganizationReadAuthorityError(value, status) {
+	if (status === 400) return new AuthError("invalid_request", 400);
+	if (status === 401) return new AuthError("authentication_required", 401);
+	if (status === 403) return new AuthError("access_denied", 403);
+	return authorityUnavailable();
+}
+function fromOrganizationMutationAuthorityError(value, status, retryAfter) {
+	if (status === 400 || status === 413 || status === 415) return new AuthError("invalid_request", 400);
+	if (status === 409) return new AuthError("state_conflict", 409);
+	if (status === 429) return new AuthError("auth_request_rate_limited", 429, parseRetryAfter(retryAfter));
+	const code = isObject(value) && typeof value.code === "string" ? value.code : void 0;
+	if (status === 403 && code === "REQUEST_ORIGIN_DENIED") return new AuthError("request_origin_denied", 403);
+	return fromOrganizationReadAuthorityError(value, status);
+}
 function fromInvitationAuthorityError(value, status) {
 	const code = isObject(value) && typeof value.code === "string" ? value.code : void 0;
 	if (status === 401 && code === "UNAUTHORIZED") return new AuthError("authentication_required", 401);
@@ -675,6 +961,46 @@ function toDate(value) {
 function isId(value) {
 	return typeof value === "string" && id.test(value);
 }
+function exact(value, keys) {
+	if (!isObject(value) || Object.keys(value).sort().join(",") !== [...keys].sort().join(",")) throw authorityUnavailable();
+}
+function boundedString(value, maximum) {
+	return typeof value === "string" && value.length > 0 && new TextEncoder().encode(value).byteLength <= maximum;
+}
+function role(value) {
+	return value === "owner" || value === "admin" || value === "member";
+}
+function nullableHttpsUrl(value) {
+	if (value === null) return null;
+	if (typeof value !== "string" || value.length > 2048) throw authorityUnavailable();
+	let url;
+	try {
+		url = new URL(value);
+	} catch {
+		throw authorityUnavailable();
+	}
+	if (url.protocol !== "https:" || url.username || url.password || url.toString() !== value) throw authorityUnavailable();
+	return value;
+}
+function responseDate(value) {
+	if (typeof value !== "string") throw authorityUnavailable();
+	const date = new Date(value);
+	if (!Number.isFinite(date.getTime()) || date.toISOString() !== value) throw authorityUnavailable();
+	return date;
+}
+function nullableCursor(value) {
+	if (value === null) return null;
+	if (typeof value !== "string" || value.length < 1 || value.length > 820 || !/^[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+$/.test(value)) throw authorityUnavailable();
+	return value;
+}
+function normalizeResponseId(value) {
+	if (!isId(value)) throw authorityUnavailable();
+	return value;
+}
+function unique(items, key) {
+	if (new Set(items.map(key)).size !== items.length) throw authorityUnavailable();
+	return items;
+}
 function isObject(value) {
 	return typeof value === "object" && value !== null && !Array.isArray(value);
 }
@@ -704,18 +1030,18 @@ async function requestJsonResponse(url, options) {
 	}
 	const contentType = response.headers.get("content-type")?.split(";", 1)[0]?.trim().toLowerCase();
 	if (response.status >= 300 || response.status < 200 || contentType !== "application/json") {
-		const body = contentType === "application/json" ? await readJson(response) : void 0;
+		const body = contentType === "application/json" ? await readJson(response, options.maxResponseBytes) : void 0;
 		await response.body?.cancel();
 		throw (options.mapError ?? fromAuthorityError)(body, response.status, response.headers.get("retry-after"));
 	}
 	return {
-		value: await readJson(response),
+		value: await readJson(response, options.maxResponseBytes),
 		headers: response.headers
 	};
 }
-async function readJson(response) {
+async function readJson(response, maximum = MAX_RESPONSE_BYTES) {
 	const length = response.headers.get("content-length");
-	if (length && (!/^\d+$/.test(length) || Number(length) > MAX_RESPONSE_BYTES)) {
+	if (length && (!/^\d+$/.test(length) || Number(length) > maximum)) {
 		await response.body?.cancel();
 		throw authorityUnavailable();
 	}
@@ -728,7 +1054,7 @@ async function readJson(response) {
 			const { done, value } = await reader.read();
 			if (done) break;
 			size += value.byteLength;
-			if (size > MAX_RESPONSE_BYTES) throw authorityUnavailable();
+			if (size > maximum) throw authorityUnavailable();
 			chunks.push(value);
 		}
 	} catch (error) {
@@ -766,6 +1092,18 @@ function createServerAuth(options) {
 		...authorization ? { authorization } : { cookie },
 		...includeOrigin ? { origin: appOrigin } : {}
 	});
+	async function organizationRead(path, input, normalize) {
+		const query = normalizeOrganizationPageInput(input);
+		return normalize(await requestJson(`${joinURL(authOrigin, "api/v1/auth/organizations", path)}${query.size ? `?${query}` : ""}`, {
+			fetch: fetchImpl,
+			timeoutMs,
+			method: "GET",
+			credentials,
+			headers: authHeaders(false),
+			mapError: fromOrganizationReadAuthorityError,
+			maxResponseBytes: 256 * 1024
+		}));
+	}
 	return {
 		async acceptInvitation(input) {
 			const invitation = normalizeInvitationInput(input);
@@ -803,19 +1141,102 @@ function createServerAuth(options) {
 				headers: authHeaders(false)
 			}));
 		},
-		async listOrganizations() {
+		async listOrganizations(input) {
 			try {
-				return normalizeOrganizations(await requestJson(joinURL(authOrigin, "api/v1/auth/organization/list"), {
-					fetch: fetchImpl,
-					timeoutMs,
-					method: "GET",
-					credentials,
-					headers: authHeaders()
-				}));
+				return await organizationRead("", input, normalizeOrganizations);
 			} catch (error) {
 				throw fromOrganizationListError(error);
 			}
 		},
+		getOrganization(organizationId) {
+			return organizationRead(normalizeIdInput(organizationId), void 0, normalizeOrganization);
+		},
+		async createOrganizationTeam(organizationId, name, idempotencyKey) {
+			const id = normalizeIdInput(organizationId);
+			const body = normalizeOrganizationTeamCreationInput(name, idempotencyKey);
+			return normalizeCreatedOrganizationTeam(await requestJson(joinURL(authOrigin, "api/v1/auth/organizations", id, "teams"), {
+				fetch: fetchImpl,
+				timeoutMs,
+				method: "POST",
+				credentials,
+				headers: {
+					...authHeaders(!authorization),
+					"content-type": "application/json"
+				},
+				body,
+				mapError: fromOrganizationMutationAuthorityError
+			}));
+		},
+		async createOrganizationMemberInvitation(organizationId, input) {
+			const id = normalizeIdInput(organizationId);
+			const body = normalizeOrganizationMemberInvitationCreationInput(input);
+			return normalizeCreatedOrganizationMemberInvitation(await requestJson(joinURL(authOrigin, "api/v1/auth/organizations", id, "invitations"), {
+				fetch: fetchImpl,
+				timeoutMs,
+				method: "POST",
+				credentials,
+				headers: {
+					...authHeaders(!authorization),
+					"content-type": "application/json"
+				},
+				body,
+				mapError: fromOrganizationMutationAuthorityError
+			}));
+		},
+		async updateOrganizationDisplay(organizationId, input) {
+			const id = normalizeIdInput(organizationId);
+			const desired = normalizeOrganizationDisplayInput(input);
+			return normalizeOrganizationDisplay(await requestJson(joinURL(authOrigin, "api/v1/auth/organizations", id, "display"), {
+				fetch: fetchImpl,
+				timeoutMs,
+				method: "POST",
+				credentials,
+				headers: {
+					...authHeaders(!authorization),
+					"content-type": "application/json"
+				},
+				body: desired,
+				mapError: fromOrganizationMutationAuthorityError
+			}));
+		},
+		async updateOrganizationTeamDisplay(organizationId, teamId, input) {
+			const organization = normalizeIdInput(organizationId);
+			const team = normalizeIdInput(teamId);
+			const desired = normalizeOrganizationTeamDisplayInput(input);
+			return normalizeOrganizationTeamDisplay(await requestJson(joinURL(authOrigin, "api/v1/auth/organizations", organization, "teams", team, "display"), {
+				fetch: fetchImpl,
+				timeoutMs,
+				method: "POST",
+				credentials,
+				headers: {
+					...authHeaders(!authorization),
+					"content-type": "application/json"
+				},
+				body: desired,
+				mapError: fromOrganizationMutationAuthorityError
+			}));
+		},
+		listOrganizationMembers(organizationId, input) {
+			return organizationRead(`${normalizeIdInput(organizationId)}/members`, input, normalizeOrganizationMembers);
+		},
+		listOrganizationTeams(organizationId, input) {
+			return organizationRead(`${normalizeIdInput(organizationId)}/teams`, input, normalizeOrganizationTeams);
+		},
+		listOrganizationTeamMembers(organizationId, teamId, input) {
+			return organizationRead(`${normalizeIdInput(organizationId)}/teams/${normalizeIdInput(teamId)}/members`, input, normalizeOrganizationTeamMembers);
+		},
+		listOrganizationInvitations(organizationId, input) {
+			return organizationRead(`${normalizeIdInput(organizationId)}/invitations`, input, normalizeOrganizationInvitations);
+		},
+		getOrganizationInvitation(organizationId, invitationId) {
+			return organizationRead(`${normalizeIdInput(organizationId)}/invitations/${normalizeIdInput(invitationId)}`, void 0, normalizeOrganizationInvitation);
+		},
+		listReceivedInvitations(input) {
+			return organizationRead("received-invitations", input, normalizeReceivedInvitations);
+		},
+		getReceivedInvitation(invitationId) {
+			return organizationRead(`received-invitations/${normalizeIdInput(invitationId)}`, void 0, normalizeReceivedInvitation);
+		},
 		async signInWithSocialIdToken(input) {
 			if (authorization) throw new AuthError("state_conflict", 409);
 			const body = socialIdTokenRequest(normalizeSocialIdTokenInput(input));