@fluixi/oauth2 1.0.0-alpha.1 → 1.0.0-alpha.100

package/dist/server.d.ts

@@ -1,5 +1,7 @@
 import { type ClientAuthMethodInput } from './client-auth.js';
+import { type LogoutStore } from './backchannel.js';
 import { type Endpoints } from './types.js';
+import { type AppModule } from '@fluixi/start/app';
 export interface OAuthRoutesConfig {
     issuer?: string;
     endpoints?: Endpoints;
@@ -17,6 +19,12 @@ export interface OAuthRoutesConfig {
     secureCookie?: boolean;
     /** Where to send the browser after a login with no recorded destination. */
     defaultReturnTo?: string;
+    /**
+     * Where back-channel logouts are kept, between the route that hears them and the requests
+     * that end their sessions. Default: this process's memory, right for one instance; several
+     * instances share one (see `LogoutStore`).
+     */
+    logouts?: LogoutStore;
     /**
      * Origins a login may return to besides this server's own.
      *
@@ -50,15 +58,61 @@ export interface OAuthRoutesConfig {
      * short. `0` disables it and asks every time.
      */
     userCacheMs?: number;
+    /**
+     * How long a token request may take, in milliseconds, before it is abandoned. Default
+     * 10 000. A renewal abandoned this way may have been processed, so its refresh token is not
+     * sent again and the session ends; the provider's own session usually signs the person back
+     * in without a prompt.
+     */
+    tokenTimeoutMs?: number;
     /** Map the provider's userinfo onto the app's own shape. */
     mapUser?: (claims: Record<string, unknown>, accessToken: string) => unknown;
+    /**
+     * Bind tokens to a key with DPoP (RFC 9449), which a provider may require: an Okta org
+     * that mandates it refuses a server-mode client without it.
+     *
+     * The key is made per session at the code exchange and kept in the encrypted session
+     * cookie, since a refresh token is bound to the key that obtained it and a refresh with
+     * another key is refused. Needs `jose`.
+     */
+    dpop?: boolean;
+    /** Default `ES256`. Must be in the provider's `dpop_signing_alg_values_supported`. */
+    dpopAlgorithm?: string;
+    /**
+     * What a page request from a signed-out visitor does.
+     *
+     * - `manual` (default): the page renders signed out and offers a way to sign in.
+     * - `silent`: the visitor is sent to the provider with `prompt=none`. Someone already
+     *   signed in there comes back signed in without a click; anyone else comes straight back
+     *   and the page renders signed out, and is not asked again for `silentRecheck` seconds.
+     *   Single sign-on without forcing a sign-in on a public page.
+     * - `required`: the visitor is sent to sign in. For an app with nothing to show to a
+     *   stranger, an admin console say.
+     *
+     * Only page loads are redirected (a GET for a document), never an API or asset request.
+     */
+    signIn?: 'manual' | 'silent' | 'required';
+    /**
+     * How long `silent` takes a "nobody signed in" answer as current, in seconds. Default 60.
+     * Someone who signs in at the provider afterwards (in another app, another tab) is picked
+     * up on their first page load after it. Longer saves round trips for anonymous visitors.
+     */
+    silentRecheck?: number;
+    /** Paths `silent` and `required` leave alone, besides the auth routes: `/health`, `/legal`. */
+    publicPaths?: string[];
+    /**
+     * Paths that always need someone signed in, whatever `signIn` says for the rest: a public
+     * site with a private area (`/o` for a workspace) sends a signed-out page load there to
+     * sign in, and shows the other pages as `signIn` decides.
+     */
+    protectedPaths?: string[];
 }
 /**
- * The middleware.
- *
- * Handles `<basePath>/login`, `/callback`, `/refresh`, `/me` and `/logout`, and passes
- * anything else along untouched.
+ * A request carrying the session's access token: the `DPoP` scheme and a proof bound to the
+ * token when the provider bound it, `Bearer` otherwise.
  */
+/** `fetch`, as the signed-in user. What `locals.auth.fetch` is. */
+export type AuthorizedFetch = (input: string | URL, init?: RequestInit) => Promise<Response>;
 export declare function oauthRoutes(config: OAuthRoutesConfig): (request: Request, next: () => Promise<Response>) => Promise<Response>;
 /**
  * Put the signed-in user on the request, so a server render knows who is looking.
@@ -86,4 +140,37 @@ export declare function oauthRoutes(config: OAuthRoutesConfig): (request: Reques
  * having its session resolved first.
  */
 export declare function sessionLocals(config: OAuthRoutesConfig): (request: Request, next: () => Promise<Response>) => Promise<Response>;
+/** What `sessionLocals` leaves on a request: the user, and a `fetch` that calls as them. */
+export interface ServerAuth<U = unknown> {
+    user: U | null;
+    session: {
+        expiresAt?: number;
+    } | null;
+    /** Absent when nobody is signed in. */
+    fetch?: AuthorizedFetch;
+    /**
+     * The visitor has a session but the provider could not be reached to confirm it: tell them
+     * it is down, rather than asking them to sign in again.
+     */
+    unreachable?: boolean;
+}
+/**
+ * The request's auth, for server code: a route's data loader, a server function, an API route.
+ * Reads the current request's locals, or `request`'s when one is given.
+ *
+ * ```ts
+ * const { fetch } = await requestAuth();
+ * const projects = await fetch?.(`${apiUrl}/projects`).then((r) => r.json());
+ * ```
+ */
+export declare function requestAuth<U = unknown>(request?: Request): Promise<ServerAuth<U>>;
+/**
+ * The server half of `authModule`, listed in `src/app.config.server.ts`: the routes and the
+ * session middleware that `tokens: 'server'` needs, in the order they have to run.
+ *
+ * `oauthRoutes` first, so a request to the login route is answered rather than having its
+ * session resolved on the way past.
+ */
+export declare function authServerModule(config: OAuthRoutesConfig): AppModule;
+export { memoryLogouts, type LogoutEntry, type LogoutStore } from './backchannel.js';
 //# sourceMappingURL=server.d.ts.map

package/dist/server.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"server.d.ts","sourceRoot":"","sources":["../src/server.ts"],"names":[],"mappings":"AAgCA,OAAO,EAGL,KAAK,qBAAqB,EAC3B,MAAM,kBAAkB,CAAC;AAG1B,OAAO,EAAc,KAAK,SAAS,EAAE,MAAM,YAAY,CAAC;AAExD,MAAM,WAAW,iBAAiB;IAChC,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,SAAS,CAAC,EAAE,SAAS,CAAC;IACtB,QAAQ,EAAE,MAAM,CAAC;IACjB,8EAA8E;IAC9E,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,WAAW,EAAE,MAAM,CAAC;IACpB,MAAM,CAAC,EAAE,MAAM,EAAE,CAAC;IAClB,yFAAyF;IACzF,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,6EAA6E;IAC7E,YAAY,EAAE,MAAM,CAAC;IACrB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,6EAA6E;IAC7E,YAAY,CAAC,EAAE,OAAO,CAAC;IACvB,4EAA4E;IAC5E,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB;;;;;;;OAOG;IACH,oBAAoB,CAAC,EAAE,MAAM,EAAE,CAAC;IAChC;;;;;OAKG;IACH,eAAe,CAAC,EAAE,qBAAqB,CAAC;IACxC,uDAAuD;IACvD,UAAU,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACrC,6DAA6D;IAC7D,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,uBAAuB;IACvB,kBAAkB,CAAC,EAAE,MAAM,CAAC;IAC5B;;;;;;;;;OASG;IACH,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,4DAA4D;IAC5D,OAAO,CAAC,EAAE,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,WAAW,EAAE,MAAM,KAAK,OAAO,CAAC;CAC7E;AAYD;;;;;GAKG;AACH,wBAAgB,WAAW,CAAC,MAAM,EAAE,iBAAiB,IAwDjD,SAAS,OAAO,EAChB,MAAM,MAAM,OAAO,CAAC,QAAQ,CAAC,KAC5B,OAAO,CAAC,QAAQ,CAAC,CAwMrB;AAED;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AACH,wBAAgB,aAAa,CAAC,MAAM,EAAE,iBAAiB,IA8BnD,SAAS,OAAO,EAChB,MAAM,MAAM,OAAO,CAAC,QAAQ,CAAC,KAC5B,OAAO,CAAC,QAAQ,CAAC,CA0CrB"}
+{"version":3,"file":"server.d.ts","sourceRoot":"","sources":["../src/server.ts"],"names":[],"mappings":"AAgCA,OAAO,EAGL,KAAK,qBAAqB,EAC3B,MAAM,kBAAkB,CAAC;AAE1B,OAAO,EAAqD,KAAK,WAAW,EAAE,MAAM,kBAAkB,CAAC;AAEvG,OAAO,EAAc,KAAK,SAAS,EAAE,MAAM,YAAY,CAAC;AAExD,OAAO,EAAgB,KAAK,SAAS,EAAE,MAAM,mBAAmB,CAAC;AAEjE,MAAM,WAAW,iBAAiB;IAChC,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,SAAS,CAAC,EAAE,SAAS,CAAC;IACtB,QAAQ,EAAE,MAAM,CAAC;IACjB,8EAA8E;IAC9E,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,WAAW,EAAE,MAAM,CAAC;IACpB,MAAM,CAAC,EAAE,MAAM,EAAE,CAAC;IAClB,yFAAyF;IACzF,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,6EAA6E;IAC7E,YAAY,EAAE,MAAM,CAAC;IACrB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,6EAA6E;IAC7E,YAAY,CAAC,EAAE,OAAO,CAAC;IACvB,4EAA4E;IAC5E,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB;;;;OAIG;IACH,OAAO,CAAC,EAAE,WAAW,CAAC;IACtB;;;;;;;OAOG;IACH,oBAAoB,CAAC,EAAE,MAAM,EAAE,CAAC;IAChC;;;;;OAKG;IACH,eAAe,CAAC,EAAE,qBAAqB,CAAC;IACxC,uDAAuD;IACvD,UAAU,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACrC,6DAA6D;IAC7D,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,uBAAuB;IACvB,kBAAkB,CAAC,EAAE,MAAM,CAAC;IAC5B;;;;;;;;;OASG;IACH,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB;;;;;OAKG;IACH,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,4DAA4D;IAC5D,OAAO,CAAC,EAAE,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,WAAW,EAAE,MAAM,KAAK,OAAO,CAAC;IAC5E;;;;;;;OAOG;IACH,IAAI,CAAC,EAAE,OAAO,CAAC;IACf,sFAAsF;IACtF,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB;;;;;;;;;;;;OAYG;IACH,MAAM,CAAC,EAAE,QAAQ,GAAG,QAAQ,GAAG,UAAU,CAAC;IAC1C;;;;OAIG;IACH,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,+FAA+F;IAC/F,WAAW,CAAC,EAAE,MAAM,EAAE,CAAC;IACvB;;;;OAIG;IACH,cAAc,CAAC,EAAE,MAAM,EAAE,CAAC;CAC3B;AAwGD;;;GAGG;AACH,mEAAmE;AACnE,MAAM,MAAM,eAAe,GAAG,CAAC,KAAK,EAAE,MAAM,GAAG,GAAG,EAAE,IAAI,CAAC,EAAE,WAAW,KAAK,OAAO,CAAC,QAAQ,CAAC,CAAC;AA4O7F,wBAAgB,WAAW,CAAC,MAAM,EAAE,iBAAiB,IAgBjD,SAAS,OAAO,EAChB,MAAM,MAAM,OAAO,CAAC,QAAQ,CAAC,KAC5B,OAAO,CAAC,QAAQ,CAAC,CAkSrB;AAED;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AACH,wBAAgB,aAAa,CAAC,MAAM,EAAE,iBAAiB,IA+BnD,SAAS,OAAO,EAChB,MAAM,MAAM,OAAO,CAAC,QAAQ,CAAC,KAC5B,OAAO,CAAC,QAAQ,CAAC,CAmGrB;AAED,4FAA4F;AAC5F,MAAM,WAAW,UAAU,CAAC,CAAC,GAAG,OAAO;IACrC,IAAI,EAAE,CAAC,GAAG,IAAI,CAAC;IACf,OAAO,EAAE;QAAE,SAAS,CAAC,EAAE,MAAM,CAAA;KAAE,GAAG,IAAI,CAAC;IACvC,uCAAuC;IACvC,KAAK,CAAC,EAAE,eAAe,CAAC;IACxB;;;OAGG;IACH,WAAW,CAAC,EAAE,OAAO,CAAC;CACvB;AAED;;;;;;;;GAQG;AACH,wBAAsB,WAAW,CAAC,CAAC,GAAG,OAAO,EAAE,OAAO,CAAC,EAAE,OAAO,GAAG,OAAO,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,CAIxF;AAED;;;;;;GAMG;AACH,wBAAgB,gBAAgB,CAAC,MAAM,EAAE,iBAAiB,GAAG,SAAS,CAErE;AAED,OAAO,EAAE,aAAa,EAAE,KAAK,WAAW,EAAE,KAAK,WAAW,EAAE,MAAM,kBAAkB,CAAC"}