@flytedesk/app-kit 0.0.1 → 0.1.1

package/dist/auth/plugin.js

@@ -0,0 +1,362 @@
+import { randomUUID } from "node:crypto";
+import fp from "fastify-plugin";
+import fastifyCookie from "@fastify/cookie";
+import { createOidcClient } from "./oidc-client.js";
+import { generatePkce, randomState } from "./pkce.js";
+import { generateRefreshToken, hashRefreshToken, signAccessToken, verifyAccessToken } from "./tokens.js";
+const DEFAULT_ROUTE_PREFIX = "/auth";
+const DEFAULT_ACCESS_TOKEN_TTL_SECONDS = 900;
+const DEFAULT_REFRESH_TOKEN_TTL_SECONDS = 2_592_000;
+const DEFAULT_LOGIN_ATTEMPT_TTL_SECONDS = 600;
+const REQUIRED_STRING_OPTIONS = [
+    "clientId",
+    "clientSecret",
+    "issuer",
+    "redirectUri",
+    "appId",
+    "postLoginRedirect",
+    "accessTokenSecret",
+];
+function assertRequiredOptions(options) {
+    for (const key of REQUIRED_STRING_OPTIONS) {
+        const value = options[key];
+        if (typeof value !== "string" || value.length === 0) {
+            throw new Error(`@flytedesk/app-kit/auth: missing required option "${key}"`);
+        }
+    }
+    if (options.cookieSecret == null ||
+        (Array.isArray(options.cookieSecret) ? options.cookieSecret.length === 0 : options.cookieSecret.length === 0)) {
+        throw new Error('@flytedesk/app-kit/auth: missing required option "cookieSecret"');
+    }
+    if (typeof options.secureCookies !== "boolean") {
+        throw new Error('@flytedesk/app-kit/auth: missing required option "secureCookies"');
+    }
+    if (!options.store) {
+        throw new Error('@flytedesk/app-kit/auth: missing required option "store"');
+    }
+}
+const flytedeskAuthPlugin = async (fastify, options) => {
+    assertRequiredOptions(options);
+    const routePrefix = options.routePrefix ?? DEFAULT_ROUTE_PREFIX;
+    const accessTokenTtlSeconds = options.accessTokenTtlSeconds ?? DEFAULT_ACCESS_TOKEN_TTL_SECONDS;
+    const refreshTokenTtlSeconds = options.refreshTokenTtlSeconds ?? DEFAULT_REFRESH_TOKEN_TTL_SECONDS;
+    const loginAttemptTtlSeconds = options.loginAttemptTtlSeconds ?? DEFAULT_LOGIN_ATTEMPT_TTL_SECONDS;
+    const store = options.store;
+    if (options.authorizationCacheTtlMs) {
+        fastify.log.warn({ authorizationCacheTtlMs: options.authorizationCacheTtlMs }, "@flytedesk/app-kit/auth: authorizationCacheTtlMs is set — flytedesk-id authorization " +
+            "checks will be cached instead of live. A role/permission revoked in flytedesk-id can " +
+            "keep working here for up to that long. Confirm this tradeoff is intentional.");
+    }
+    const oidc = createOidcClient({
+        issuer: options.issuer,
+        clientId: options.clientId,
+        clientSecret: options.clientSecret,
+        redirectUri: options.redirectUri,
+    });
+    await fastify.register(fastifyCookie, { secret: options.cookieSecret });
+    fastify.decorateRequest("authUser", undefined);
+    // __Host- requires Secure, no Domain attribute, and Path=/ — so the prefix (and the
+    // Path=/ it forces) is only used when options.secureCookies says this is actually an
+    // HTTPS deployment. Plain, routePrefix-scoped cookies are used for local HTTP dev,
+    // where __Host- would just make the browser silently refuse to set the cookie.
+    const useHostPrefix = options.secureCookies;
+    const refreshCookieName = useHostPrefix ? "__Host-fd_refresh" : "fd_refresh";
+    const loginCookieName = useHostPrefix ? "__Host-fd_login_attempt" : "fd_login_attempt";
+    const cookiePath = useHostPrefix ? "/" : routePrefix;
+    function refreshCookieOptions(maxAgeSeconds) {
+        return {
+            httpOnly: true,
+            sameSite: "lax",
+            secure: options.secureCookies,
+            path: cookiePath,
+            maxAge: maxAgeSeconds,
+        };
+    }
+    const authorizationCache = new Map();
+    /**
+     * Live per-request by default: resolves `request.authUser` from the access token's
+     * `sid` by looking up the IdpSession, refreshing the IdP token pair if it's near
+     * expiry, then calling flytedesk-id's authorization endpoint fresh — see
+     * FlytedeskAuthOptions.authorizationCacheTtlMs for the one opt-in exception. Never
+     * throws: any failure just means no AuthedUser gets attached.
+     */
+    async function loadAuthedUser(claims) {
+        const session = await store.findIdpSession(claims.sid);
+        if (!session || session.subject !== claims.sub)
+            return undefined;
+        let idpAccessToken = session.idpAccessToken;
+        const EXPIRY_SKEW_MS = 5_000;
+        if (session.idpAccessTokenExpiresAt.getTime() - EXPIRY_SKEW_MS < Date.now()) {
+            if (!session.idpRefreshToken)
+                return undefined; // nothing left to refresh with — force re-login
+            try {
+                const refreshed = await oidc.refreshIdpTokens(session.idpRefreshToken);
+                idpAccessToken = refreshed.access_token;
+                await store.updateIdpSession(session.id, {
+                    idpAccessToken: refreshed.access_token,
+                    idpAccessTokenExpiresAt: new Date(Date.now() + refreshed.expires_in * 1000),
+                    // flytedesk-id rotates refresh tokens on every use — must persist the new one.
+                    idpRefreshToken: refreshed.refresh_token ?? session.idpRefreshToken,
+                });
+            }
+            catch {
+                return undefined; // flytedesk-id refresh token revoked/expired — force re-login
+            }
+        }
+        let authorization;
+        if (options.authorizationCacheTtlMs) {
+            const cached = authorizationCache.get(claims.sid);
+            if (cached && cached.expiresAt > Date.now())
+                authorization = cached.value;
+        }
+        if (!authorization) {
+            try {
+                authorization = await oidc.fetchAuthorization(idpAccessToken, options.appId);
+            }
+            catch {
+                return undefined;
+            }
+            if (options.authorizationCacheTtlMs) {
+                authorizationCache.set(claims.sid, {
+                    value: authorization,
+                    expiresAt: Date.now() + options.authorizationCacheTtlMs,
+                });
+            }
+        }
+        // flytedesk-id's permission keys are app-prefixed ("<appId>:plan.view") so they
+        // never collide across apps in its catalog — strip the prefix so the consuming
+        // app's own permission checks don't have to know about it.
+        const prefix = `${options.appId}:`;
+        return {
+            id: session.subject,
+            email: session.email,
+            name: session.name,
+            sessionId: session.id,
+            roles: authorization.roles,
+            permissions: authorization.permissions.map((p) => (p.startsWith(prefix) ? p.slice(prefix.length) : p)),
+        };
+    }
+    // onRequest, not preHandler: this needs to run before any route-level preHandler
+    // (requireAuth/requirePermission included) so request.authUser is already resolved
+    // by the time those run.
+    fastify.addHook("onRequest", async (request) => {
+        const header = request.headers.authorization;
+        if (!header?.startsWith("Bearer "))
+            return;
+        try {
+            const claims = await verifyAccessToken(options.accessTokenSecret, header.slice(7));
+            const user = await loadAuthedUser(claims);
+            if (user)
+                request.authUser = user;
+        }
+        catch {
+            // Invalid/expired access token: leave request.authUser unset; requireAuth 401s.
+        }
+    });
+    async function issueSession(request, reply, userId, idpSessionId, familyId) {
+        const { token: refreshToken, hash } = generateRefreshToken();
+        const expiresAt = new Date(Date.now() + refreshTokenTtlSeconds * 1000);
+        await store.createRefreshToken({
+            id: randomUUID(),
+            familyId,
+            userId,
+            tokenHash: hash,
+            expiresAt,
+            idpSessionId,
+            userAgent: request.headers["user-agent"] ?? null,
+            ip: request.ip,
+        });
+        const { token: accessToken, expiresAt: accessExpiresAt } = await signAccessToken(options.accessTokenSecret, accessTokenTtlSeconds, userId, idpSessionId);
+        reply.setCookie(refreshCookieName, refreshToken, refreshCookieOptions(refreshTokenTtlSeconds));
+        return { accessToken, accessTokenExpiresAt: accessExpiresAt.toISOString() };
+    }
+    /**
+     * GET {routePrefix}/login — starts the flytedesk-id sign-in. A plain redirect meant
+     * to be hit via full-page navigation, not fetch/XHR. Generates a PKCE verifier/
+     * challenge (S256 — flytedesk-id makes PKCE mandatory) and a CSRF `state`, stashes
+     * both in a short-lived signed cookie tied to this browser, then redirects to
+     * flytedesk-id's own /auth endpoint.
+     */
+    fastify.get(`${routePrefix}/login`, async (request, reply) => {
+        const { verifier, challenge } = generatePkce();
+        const state = randomState();
+        reply.setCookie(loginCookieName, JSON.stringify({ verifier, state }), {
+            httpOnly: true,
+            sameSite: "lax",
+            secure: options.secureCookies,
+            path: cookiePath,
+            maxAge: loginAttemptTtlSeconds,
+            signed: true,
+        });
+        return reply.redirect(oidc.buildAuthorizeUrl({ state, challenge }));
+    });
+    /**
+     * GET {routePrefix}/callback — flytedesk-id's redirect_uri for this client. Validates
+     * `state`, exchanges `code` + the stashed PKCE verifier at flytedesk-id's /token
+     * (Basic auth — the one place client_secret is used), verifies the returned
+     * id_token's signature via flytedesk-id's JWKS, fetches profile claims from
+     * userinfo, then mints this service's own session.
+     */
+    fastify.get(`${routePrefix}/callback`, async (request, reply) => {
+        const { code, state, error } = request.query;
+        const raw = request.cookies[loginCookieName];
+        reply.clearCookie(loginCookieName, { path: cookiePath });
+        if (error) {
+            return reply
+                .code(400)
+                .send({ error: `flytedesk-id sign-in failed: ${error}`, code: "idp_error" });
+        }
+        if (!code || !state || !raw) {
+            return reply.code(400).send({
+                error: "Missing code/state, or the login attempt expired",
+                code: "invalid_callback",
+            });
+        }
+        const unsigned = request.unsignCookie(raw);
+        if (!unsigned.valid || !unsigned.value) {
+            return reply.code(400).send({
+                error: "Login attempt cookie failed verification",
+                code: "invalid_login_cookie",
+            });
+        }
+        let stash;
+        try {
+            stash = JSON.parse(unsigned.value);
+        }
+        catch {
+            return reply.code(400).send({ error: "Corrupt login attempt", code: "invalid_login_cookie" });
+        }
+        if (stash.state !== state) {
+            return reply.code(400).send({ error: "State mismatch", code: "invalid_state" });
+        }
+        try {
+            const tokens = await oidc.exchangeCodeForTokens(code, stash.verifier);
+            // Confirms WHO signed in (sub) via a local signature check — aud/iss are
+            // verified inside verifyIdToken against options.clientId/options.issuer.
+            const idToken = await oidc.verifyIdToken(tokens.id_token);
+            const profile = await oidc.fetchUserinfo(tokens.access_token);
+            if (profile.sub !== idToken.sub) {
+                return reply.code(401).send({
+                    error: "flytedesk-id id_token/userinfo subject mismatch",
+                    code: "subject_mismatch",
+                });
+            }
+            if (!profile.emailVerified) {
+                return reply.code(401).send({
+                    error: "flytedesk-id account email is not verified",
+                    code: "email_not_verified",
+                });
+            }
+            if (options.onSignIn) {
+                await options.onSignIn(profile, request);
+            }
+            const name = profile.name ?? profile.email.split("@")[0];
+            const idpSession = await store.createIdpSession({
+                subject: profile.sub,
+                name,
+                email: profile.email,
+                idpAccessToken: tokens.access_token,
+                idpAccessTokenExpiresAt: new Date(Date.now() + tokens.expires_in * 1000),
+                idpRefreshToken: tokens.refresh_token ?? null,
+            });
+            // A fresh family for every login — reuse detection (see POST /refresh below)
+            // only ever revokes the chain descended from one login, never sibling sessions.
+            const familyId = randomUUID();
+            await issueSession(request, reply, profile.sub, idpSession.id, familyId);
+            return reply.redirect(options.postLoginRedirect);
+        }
+        catch (err) {
+            request.log.error({ err }, "flytedesk-id callback failed");
+            return reply
+                .code(502)
+                .send({ error: "Sign-in with flytedesk-id failed", code: "idp_exchange_failed" });
+        }
+    });
+    /**
+     * POST {routePrefix}/refresh — no body, reads the refresh cookie. Rotates it on every
+     * successful call. A hash match on a row that's already revoked means this exact
+     * token was replayed (its legitimate rotation already consumed it) — that's treated
+     * as a security event: the whole family is revoked, not just this row, since every
+     * token downstream of the replayed one must be assumed compromised too.
+     *
+     * The claim (store.claimRefreshTokenForRotation) happens BEFORE the expiry check and
+     * is what actually detects reuse — not a `stored.revokedAt` read, which would leave a
+     * window between two concurrent requests both observing "not yet revoked" before
+     * either write lands. See that method's doc comment in ./types.ts.
+     */
+    fastify.post(`${routePrefix}/refresh`, async (request, reply) => {
+        const token = request.cookies[refreshCookieName];
+        if (!token) {
+            return reply.code(401).send({ error: "No refresh token", code: "unauthenticated" });
+        }
+        const hash = hashRefreshToken(token);
+        const stored = await store.findRefreshTokenByHash(hash);
+        if (!stored) {
+            reply.clearCookie(refreshCookieName, { path: cookiePath });
+            return reply.code(401).send({ error: "Refresh token not recognized", code: "unauthenticated" });
+        }
+        const claimed = await store.claimRefreshTokenForRotation(stored.id);
+        if (!claimed) {
+            // Already revoked by the time this call's UPDATE ran — either a genuine prior
+            // revocation or a concurrent /refresh call that won the race. Both are reuse.
+            request.log.warn({ familyId: stored.familyId, userId: stored.userId }, "@flytedesk/app-kit/auth: refresh token reuse detected — revoking token family");
+            await store.revokeFamily(stored.familyId);
+            reply.clearCookie(refreshCookieName, { path: cookiePath });
+            return reply.code(401).send({ error: "Refresh token reuse detected", code: "token_reuse_detected" });
+        }
+        if (stored.expiresAt < new Date()) {
+            // Claimed (now revoked, so it can never be presented again) but past its TTL —
+            // an expired token, not a reuse event.
+            reply.clearCookie(refreshCookieName, { path: cookiePath });
+            return reply.code(401).send({ error: "Refresh token expired", code: "unauthenticated" });
+        }
+        // Rotate: the claim above already revoked the used token; issue a fresh one in the
+        // same family — limits replay if a cookie leaks, and idpSessionId carries forward
+        // unchanged so this session's link to its flytedesk-id token pair survives the
+        // rotation.
+        const next = generateRefreshToken();
+        const expiresAt = new Date(Date.now() + refreshTokenTtlSeconds * 1000);
+        await store.createRefreshToken({
+            id: randomUUID(),
+            familyId: stored.familyId,
+            userId: stored.userId,
+            tokenHash: next.hash,
+            expiresAt,
+            idpSessionId: stored.idpSessionId,
+            userAgent: request.headers["user-agent"] ?? null,
+            ip: request.ip,
+        });
+        const { token: accessToken, expiresAt: accessExpiresAt } = await signAccessToken(options.accessTokenSecret, accessTokenTtlSeconds, stored.userId, stored.idpSessionId);
+        reply.setCookie(refreshCookieName, next.token, refreshCookieOptions(refreshTokenTtlSeconds));
+        return reply.send({ accessToken, accessTokenExpiresAt: accessExpiresAt.toISOString() });
+    });
+    /**
+     * POST {routePrefix}/logout — revokes the whole refresh-token family (not just the
+     * presented cookie) and the IdpSession row, then best-effort revokes the IdP-side
+     * refresh token if flytedesk-id's discovery document advertises a revocation
+     * endpoint. flytedesk-id currently documents NOT having one, so that step is
+     * expected to no-op — it must never throw or block local logout either way, since
+     * the local session is what actually keeps a signed-out browser locked out.
+     */
+    fastify.post(`${routePrefix}/logout`, async (request, reply) => {
+        const token = request.cookies[refreshCookieName];
+        if (token) {
+            const hash = hashRefreshToken(token);
+            const stored = await store.findRefreshTokenByHash(hash);
+            if (stored) {
+                await store.revokeFamily(stored.familyId);
+                const idpSession = await store.findIdpSession(stored.idpSessionId);
+                if (idpSession?.idpRefreshToken) {
+                    await oidc.revokeIdpToken(idpSession.idpRefreshToken).catch(() => undefined);
+                }
+                await store.deleteIdpSession(stored.idpSessionId).catch(() => undefined);
+            }
+        }
+        reply.clearCookie(refreshCookieName, { path: cookiePath });
+        return reply.send({ loggedOut: true });
+    });
+};
+export const flytedeskAuth = fp(flytedeskAuthPlugin, {
+    name: "@flytedesk/app-kit/auth",
+});
+//# sourceMappingURL=plugin.js.map

package/dist/auth/plugin.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"plugin.js","sourceRoot":"","sources":["../../src/auth/plugin.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAE,MAAM,gBAAgB,CAAC;AAChC,OAAO,aAA8C,MAAM,iBAAiB,CAAC;AAE7E,OAAO,EAAE,gBAAgB,EAAyB,MAAM,kBAAkB,CAAC;AAC3E,OAAO,EAAE,YAAY,EAAE,WAAW,EAAE,MAAM,WAAW,CAAC;AACtD,OAAO,EAAE,oBAAoB,EAAE,gBAAgB,EAAE,eAAe,EAAE,iBAAiB,EAAE,MAAM,aAAa,CAAC;AAYzG,MAAM,oBAAoB,GAAG,OAAO,CAAC;AACrC,MAAM,gCAAgC,GAAG,GAAG,CAAC;AAC7C,MAAM,iCAAiC,GAAG,SAAS,CAAC;AACpD,MAAM,iCAAiC,GAAG,GAAG,CAAC;AAE9C,MAAM,uBAAuB,GAAG;IAC9B,UAAU;IACV,cAAc;IACd,QAAQ;IACR,aAAa;IACb,OAAO;IACP,mBAAmB;IACnB,mBAAmB;CACyC,CAAC;AAE/D,SAAS,qBAAqB,CAAC,OAA6B;IAC1D,KAAK,MAAM,GAAG,IAAI,uBAAuB,EAAE,CAAC;QAC1C,MAAM,KAAK,GAAG,OAAO,CAAC,GAAG,CAAC,CAAC;QAC3B,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACpD,MAAM,IAAI,KAAK,CAAC,qDAAqD,GAAG,GAAG,CAAC,CAAC;QAC/E,CAAC;IACH,CAAC;IACD,IACE,OAAO,CAAC,YAAY,IAAI,IAAI;QAC5B,CAAC,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,YAAY,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,YAAY,CAAC,MAAM,KAAK,CAAC,CAAC,EAC7G,CAAC;QACD,MAAM,IAAI,KAAK,CAAC,iEAAiE,CAAC,CAAC;IACrF,CAAC;IACD,IAAI,OAAO,OAAO,CAAC,aAAa,KAAK,SAAS,EAAE,CAAC;QAC/C,MAAM,IAAI,KAAK,CAAC,kEAAkE,CAAC,CAAC;IACtF,CAAC;IACD,IAAI,CAAC,OAAO,CAAC,KAAK,EAAE,CAAC;QACnB,MAAM,IAAI,KAAK,CAAC,0DAA0D,CAAC,CAAC;IAC9E,CAAC;AACH,CAAC;AAED,MAAM,mBAAmB,GAA6C,KAAK,EAAE,OAAO,EAAE,OAAO,EAAE,EAAE;IAC/F,qBAAqB,CAAC,OAAO,CAAC,CAAC;IAE/B,MAAM,WAAW,GAAG,OAAO,CAAC,WAAW,IAAI,oBAAoB,CAAC;IAChE,MAAM,qBAAqB,GAAG,OAAO,CAAC,qBAAqB,IAAI,gCAAgC,CAAC;IAChG,MAAM,sBAAsB,GAAG,OAAO,CAAC,sBAAsB,IAAI,iCAAiC,CAAC;IACnG,MAAM,sBAAsB,GAAG,OAAO,CAAC,sBAAsB,IAAI,iCAAiC,CAAC;IACnG,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC;IAE5B,IAAI,OAAO,CAAC,uBAAuB,EAAE,CAAC;QACpC,OAAO,CAAC,GAAG,CAAC,IAAI,CACd,EAAE,uBAAuB,EAAE,OAAO,CAAC,uBAAuB,EAAE,EAC5D,uFAAuF;YACrF,uFAAuF;YACvF,8EAA8E,CACjF,CAAC;IACJ,CAAC;IAED,MAAM,IAAI,GAAG,gBAAgB,CAAC;QAC5B,MAAM,EAAE,OAAO,CAAC,MAAM;QACtB,QAAQ,EAAE,OAAO,CAAC,QAAQ;QAC1B,YAAY,EAAE,OAAO,CAAC,YAAY;QAClC,WAAW,EAAE,OAAO,CAAC,WAAW;KACjC,CAAC,CAAC;IAEH,MAAM,OAAO,CAAC,QAAQ,CAAC,aAAa,EAAE,EAAE,MAAM,EAAE,OAAO,CAAC,YAAY,EAAE,CAAC,CAAC;IAExE,OAAO,CAAC,eAAe,CAAC,UAAU,EAAE,SAAS,CAAC,CAAC;IAE/C,oFAAoF;IACpF,qFAAqF;IACrF,mFAAmF;IACnF,+EAA+E;IAC/E,MAAM,aAAa,GAAG,OAAO,CAAC,aAAa,CAAC;IAC5C,MAAM,iBAAiB,GAAG,aAAa,CAAC,CAAC,CAAC,mBAAmB,CAAC,CAAC,CAAC,YAAY,CAAC;IAC7E,MAAM,eAAe,GAAG,aAAa,CAAC,CAAC,CAAC,yBAAyB,CAAC,CAAC,CAAC,kBAAkB,CAAC;IACvF,MAAM,UAAU,GAAG,aAAa,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,WAAW,CAAC;IAErD,SAAS,oBAAoB,CAAC,aAAqB;QACjD,OAAO;YACL,QAAQ,EAAE,IAAI;YACd,QAAQ,EAAE,KAAK;YACf,MAAM,EAAE,OAAO,CAAC,aAAa;YAC7B,IAAI,EAAE,UAAU;YAChB,MAAM,EAAE,aAAa;SACtB,CAAC;IACJ,CAAC;IAED,MAAM,kBAAkB,GAAG,IAAI,GAAG,EAA0D,CAAC;IAE7F;;;;;;OAMG;IACH,KAAK,UAAU,cAAc,CAAC,MAAoC;QAChE,MAAM,OAAO,GAAG,MAAM,KAAK,CAAC,cAAc,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QACvD,IAAI,CAAC,OAAO,IAAI,OAAO,CAAC,OAAO,KAAK,MAAM,CAAC,GAAG;YAAE,OAAO,SAAS,CAAC;QAEjE,IAAI,cAAc,GAAG,OAAO,CAAC,cAAc,CAAC;QAC5C,MAAM,cAAc,GAAG,KAAK,CAAC;QAC7B,IAAI,OAAO,CAAC,uBAAuB,CAAC,OAAO,EAAE,GAAG,cAAc,GAAG,IAAI,CAAC,GAAG,EAAE,EAAE,CAAC;YAC5E,IAAI,CAAC,OAAO,CAAC,eAAe;gBAAE,OAAO,SAAS,CAAC,CAAC,gDAAgD;YAChG,IAAI,CAAC;gBACH,MAAM,SAAS,GAAG,MAAM,IAAI,CAAC,gBAAgB,CAAC,OAAO,CAAC,eAAe,CAAC,CAAC;gBACvE,cAAc,GAAG,SAAS,CAAC,YAAY,CAAC;gBACxC,MAAM,KAAK,CAAC,gBAAgB,CAAC,OAAO,CAAC,EAAE,EAAE;oBACvC,cAAc,EAAE,SAAS,CAAC,YAAY;oBACtC,uBAAuB,EAAE,IAAI,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,SAAS,CAAC,UAAU,GAAG,IAAI,CAAC;oBAC3E,+EAA+E;oBAC/E,eAAe,EAAE,SAAS,CAAC,aAAa,IAAI,OAAO,CAAC,eAAe;iBACpE,CAAC,CAAC;YACL,CAAC;YAAC,MAAM,CAAC;gBACP,OAAO,SAAS,CAAC,CAAC,8DAA8D;YAClF,CAAC;QACH,CAAC;QAED,IAAI,aAA2C,CAAC;QAChD,IAAI,OAAO,CAAC,uBAAuB,EAAE,CAAC;YACpC,MAAM,MAAM,GAAG,kBAAkB,CAAC,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;YAClD,IAAI,MAAM,IAAI,MAAM,CAAC,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE;gBAAE,aAAa,GAAG,MAAM,CAAC,KAAK,CAAC;QAC5E,CAAC;QACD,IAAI,CAAC,aAAa,EAAE,CAAC;YACnB,IAAI,CAAC;gBACH,aAAa,GAAG,MAAM,IAAI,CAAC,kBAAkB,CAAC,cAAc,EAAE,OAAO,CAAC,KAAK,CAAC,CAAC;YAC/E,CAAC;YAAC,MAAM,CAAC;gBACP,OAAO,SAAS,CAAC;YACnB,CAAC;YACD,IAAI,OAAO,CAAC,uBAAuB,EAAE,CAAC;gBACpC,kBAAkB,CAAC,GAAG,CAAC,MAAM,CAAC,GAAG,EAAE;oBACjC,KAAK,EAAE,aAAa;oBACpB,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,OAAO,CAAC,uBAAuB;iBACxD,CAAC,CAAC;YACL,CAAC;QACH,CAAC;QAED,gFAAgF;QAChF,+EAA+E;QAC/E,2DAA2D;QAC3D,MAAM,MAAM,GAAG,GAAG,OAAO,CAAC,KAAK,GAAG,CAAC;QACnC,OAAO;YACL,EAAE,EAAE,OAAO,CAAC,OAAO;YACnB,KAAK,EAAE,OAAO,CAAC,KAAK;YACpB,IAAI,EAAE,OAAO,CAAC,IAAI;YAClB,SAAS,EAAE,OAAO,CAAC,EAAE;YACrB,KAAK,EAAE,aAAa,CAAC,KAAK;YAC1B,WAAW,EAAE,aAAa,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;SACvG,CAAC;IACJ,CAAC;IAED,iFAAiF;IACjF,mFAAmF;IACnF,yBAAyB;IACzB,OAAO,CAAC,OAAO,CAAC,WAAW,EAAE,KAAK,EAAE,OAAO,EAAE,EAAE;QAC7C,MAAM,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,aAAa,CAAC;QAC7C,IAAI,CAAC,MAAM,EAAE,UAAU,CAAC,SAAS,CAAC;YAAE,OAAO;QAC3C,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,MAAM,iBAAiB,CAAC,OAAO,CAAC,iBAAiB,EAAE,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;YACnF,MAAM,IAAI,GAAG,MAAM,cAAc,CAAC,MAAM,CAAC,CAAC;YAC1C,IAAI,IAAI;gBAAE,OAAO,CAAC,QAAQ,GAAG,IAAI,CAAC;QACpC,CAAC;QAAC,MAAM,CAAC;YACP,gFAAgF;QAClF,CAAC;IACH,CAAC,CAAC,CAAC;IAEH,KAAK,UAAU,YAAY,CACzB,OAAuB,EACvB,KAAmB,EACnB,MAAc,EACd,YAAoB,EACpB,QAAgB;QAEhB,MAAM,EAAE,KAAK,EAAE,YAAY,EAAE,IAAI,EAAE,GAAG,oBAAoB,EAAE,CAAC;QAC7D,MAAM,SAAS,GAAG,IAAI,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,sBAAsB,GAAG,IAAI,CAAC,CAAC;QACvE,MAAM,KAAK,CAAC,kBAAkB,CAAC;YAC7B,EAAE,EAAE,UAAU,EAAE;YAChB,QAAQ;YACR,MAAM;YACN,SAAS,EAAE,IAAI;YACf,SAAS;YACT,YAAY;YACZ,SAAS,EAAG,OAAO,CAAC,OAAO,CAAC,YAAY,CAAwB,IAAI,IAAI;YACxE,EAAE,EAAE,OAAO,CAAC,EAAE;SACf,CAAC,CAAC;QAEH,MAAM,EAAE,KAAK,EAAE,WAAW,EAAE,SAAS,EAAE,eAAe,EAAE,GAAG,MAAM,eAAe,CAC9E,OAAO,CAAC,iBAAiB,EACzB,qBAAqB,EACrB,MAAM,EACN,YAAY,CACb,CAAC;QACF,KAAK,CAAC,SAAS,CAAC,iBAAiB,EAAE,YAAY,EAAE,oBAAoB,CAAC,sBAAsB,CAAC,CAAC,CAAC;QAC/F,OAAO,EAAE,WAAW,EAAE,oBAAoB,EAAE,eAAe,CAAC,WAAW,EAAE,EAAE,CAAC;IAC9E,CAAC;IAED;;;;;;OAMG;IACH,OAAO,CAAC,GAAG,CAAC,GAAG,WAAW,QAAQ,EAAE,KAAK,EAAE,OAAO,EAAE,KAAK,EAAE,EAAE;QAC3D,MAAM,EAAE,QAAQ,EAAE,SAAS,EAAE,GAAG,YAAY,EAAE,CAAC;QAC/C,MAAM,KAAK,GAAG,WAAW,EAAE,CAAC;QAE5B,KAAK,CAAC,SAAS,CAAC,eAAe,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC,EAAE;YACpE,QAAQ,EAAE,IAAI;YACd,QAAQ,EAAE,KAAK;YACf,MAAM,EAAE,OAAO,CAAC,aAAa;YAC7B,IAAI,EAAE,UAAU;YAChB,MAAM,EAAE,sBAAsB;YAC9B,MAAM,EAAE,IAAI;SACb,CAAC,CAAC;QAEH,OAAO,KAAK,CAAC,QAAQ,CAAC,IAAI,CAAC,iBAAiB,CAAC,EAAE,KAAK,EAAE,SAAS,EAAE,CAAC,CAAC,CAAC;IACtE,CAAC,CAAC,CAAC;IAEH;;;;;;OAMG;IACH,OAAO,CAAC,GAAG,CACT,GAAG,WAAW,WAAW,EACzB,KAAK,EAAE,OAAO,EAAE,KAAK,EAAE,EAAE;QACvB,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,KAAK,EAAE,GAAG,OAAO,CAAC,KAAK,CAAC;QAC7C,MAAM,GAAG,GAAG,OAAO,CAAC,OAAO,CAAC,eAAe,CAAC,CAAC;QAC7C,KAAK,CAAC,WAAW,CAAC,eAAe,EAAE,EAAE,IAAI,EAAE,UAAU,EAAE,CAAC,CAAC;QAEzD,IAAI,KAAK,EAAE,CAAC;YACV,OAAO,KAAK;iBACT,IAAI,CAAC,GAAG,CAAC;iBACT,IAAI,CAAC,EAAE,KAAK,EAAE,gCAAgC,KAAK,EAAE,EAAE,IAAI,EAAE,WAAW,EAAE,CAAC,CAAC;QACjF,CAAC;QACD,IAAI,CAAC,IAAI,IAAI,CAAC,KAAK,IAAI,CAAC,GAAG,EAAE,CAAC;YAC5B,OAAO,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC;gBAC1B,KAAK,EAAE,kDAAkD;gBACzD,IAAI,EAAE,kBAAkB;aACzB,CAAC,CAAC;QACL,CAAC;QAED,MAAM,QAAQ,GAAG,OAAO,CAAC,YAAY,CAAC,GAAG,CAAC,CAAC;QAC3C,IAAI,CAAC,QAAQ,CAAC,KAAK,IAAI,CAAC,QAAQ,CAAC,KAAK,EAAE,CAAC;YACvC,OAAO,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC;gBAC1B,KAAK,EAAE,0CAA0C;gBACjD,IAAI,EAAE,sBAAsB;aAC7B,CAAC,CAAC;QACL,CAAC;QAED,IAAI,KAA0C,CAAC;QAC/C,IAAI,CAAC;YACH,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,KAAK,CAAwC,CAAC;QAC5E,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,uBAAuB,EAAE,IAAI,EAAE,sBAAsB,EAAE,CAAC,CAAC;QAChG,CAAC;QACD,IAAI,KAAK,CAAC,KAAK,KAAK,KAAK,EAAE,CAAC;YAC1B,OAAO,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,gBAAgB,EAAE,IAAI,EAAE,eAAe,EAAE,CAAC,CAAC;QAClF,CAAC;QAED,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,qBAAqB,CAAC,IAAI,EAAE,KAAK,CAAC,QAAQ,CAAC,CAAC;YACtE,yEAAyE;YACzE,yEAAyE;YACzE,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,aAAa,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;YAC1D,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,aAAa,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC;YAC9D,IAAI,OAAO,CAAC,GAAG,KAAK,OAAO,CAAC,GAAG,EAAE,CAAC;gBAChC,OAAO,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC;oBAC1B,KAAK,EAAE,iDAAiD;oBACxD,IAAI,EAAE,kBAAkB;iBACzB,CAAC,CAAC;YACL,CAAC;YACD,IAAI,CAAC,OAAO,CAAC,aAAa,EAAE,CAAC;gBAC3B,OAAO,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC;oBAC1B,KAAK,EAAE,4CAA4C;oBACnD,IAAI,EAAE,oBAAoB;iBAC3B,CAAC,CAAC;YACL,CAAC;YAED,IAAI,OAAO,CAAC,QAAQ,EAAE,CAAC;gBACrB,MAAM,OAAO,CAAC,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;YAC3C,CAAC;YAED,MAAM,IAAI,GAAG,OAAO,CAAC,IAAI,IAAI,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAE,CAAC;YAC1D,MAAM,UAAU,GAAG,MAAM,KAAK,CAAC,gBAAgB,CAAC;gBAC9C,OAAO,EAAE,OAAO,CAAC,GAAG;gBACpB,IAAI;gBACJ,KAAK,EAAE,OAAO,CAAC,KAAK;gBACpB,cAAc,EAAE,MAAM,CAAC,YAAY;gBACnC,uBAAuB,EAAE,IAAI,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,MAAM,CAAC,UAAU,GAAG,IAAI,CAAC;gBACxE,eAAe,EAAE,MAAM,CAAC,aAAa,IAAI,IAAI;aAC9C,CAAC,CAAC;YAEH,6EAA6E;YAC7E,gFAAgF;YAChF,MAAM,QAAQ,GAAG,UAAU,EAAE,CAAC;YAC9B,MAAM,YAAY,CAAC,OAAO,EAAE,KAAK,EAAE,OAAO,CAAC,GAAG,EAAE,UAAU,CAAC,EAAE,EAAE,QAAQ,CAAC,CAAC;YAEzE,OAAO,KAAK,CAAC,QAAQ,CAAC,OAAO,CAAC,iBAAiB,CAAC,CAAC;QACnD,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,GAAG,EAAE,EAAE,8BAA8B,CAAC,CAAC;YAC3D,OAAO,KAAK;iBACT,IAAI,CAAC,GAAG,CAAC;iBACT,IAAI,CAAC,EAAE,KAAK,EAAE,kCAAkC,EAAE,IAAI,EAAE,qBAAqB,EAAE,CAAC,CAAC;QACtF,CAAC;IACH,CAAC,CACF,CAAC;IAEF;;;;;;;;;;;OAWG;IACH,OAAO,CAAC,IAAI,CAAC,GAAG,WAAW,UAAU,EAAE,KAAK,EAAE,OAAO,EAAE,KAAK,EAAE,EAAE;QAC9D,MAAM,KAAK,GAAG,OAAO,CAAC,OAAO,CAAC,iBAAiB,CAAC,CAAC;QACjD,IAAI,CAAC,KAAK,EAAE,CAAC;YACX,OAAO,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,kBAAkB,EAAE,IAAI,EAAE,iBAAiB,EAAE,CAAC,CAAC;QACtF,CAAC;QAED,MAAM,IAAI,GAAG,gBAAgB,CAAC,KAAK,CAAC,CAAC;QACrC,MAAM,MAAM,GAAG,MAAM,KAAK,CAAC,sBAAsB,CAAC,IAAI,CAAC,CAAC;QACxD,IAAI,CAAC,MAAM,EAAE,CAAC;YACZ,KAAK,CAAC,WAAW,CAAC,iBAAiB,EAAE,EAAE,IAAI,EAAE,UAAU,EAAE,CAAC,CAAC;YAC3D,OAAO,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,8BAA8B,EAAE,IAAI,EAAE,iBAAiB,EAAE,CAAC,CAAC;QAClG,CAAC;QAED,MAAM,OAAO,GAAG,MAAM,KAAK,CAAC,4BAA4B,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;QACpE,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,8EAA8E;YAC9E,8EAA8E;YAC9E,OAAO,CAAC,GAAG,CAAC,IAAI,CACd,EAAE,QAAQ,EAAE,MAAM,CAAC,QAAQ,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,EACpD,+EAA+E,CAChF,CAAC;YACF,MAAM,KAAK,CAAC,YAAY,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;YAC1C,KAAK,CAAC,WAAW,CAAC,iBAAiB,EAAE,EAAE,IAAI,EAAE,UAAU,EAAE,CAAC,CAAC;YAC3D,OAAO,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,8BAA8B,EAAE,IAAI,EAAE,sBAAsB,EAAE,CAAC,CAAC;QACvG,CAAC;QACD,IAAI,MAAM,CAAC,SAAS,GAAG,IAAI,IAAI,EAAE,EAAE,CAAC;YAClC,+EAA+E;YAC/E,uCAAuC;YACvC,KAAK,CAAC,WAAW,CAAC,iBAAiB,EAAE,EAAE,IAAI,EAAE,UAAU,EAAE,CAAC,CAAC;YAC3D,OAAO,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,uBAAuB,EAAE,IAAI,EAAE,iBAAiB,EAAE,CAAC,CAAC;QAC3F,CAAC;QAED,mFAAmF;QACnF,kFAAkF;QAClF,+EAA+E;QAC/E,YAAY;QACZ,MAAM,IAAI,GAAG,oBAAoB,EAAE,CAAC;QACpC,MAAM,SAAS,GAAG,IAAI,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,sBAAsB,GAAG,IAAI,CAAC,CAAC;QACvE,MAAM,KAAK,CAAC,kBAAkB,CAAC;YAC7B,EAAE,EAAE,UAAU,EAAE;YAChB,QAAQ,EAAE,MAAM,CAAC,QAAQ;YACzB,MAAM,EAAE,MAAM,CAAC,MAAM;YACrB,SAAS,EAAE,IAAI,CAAC,IAAI;YACpB,SAAS;YACT,YAAY,EAAE,MAAM,CAAC,YAAY;YACjC,SAAS,EAAG,OAAO,CAAC,OAAO,CAAC,YAAY,CAAwB,IAAI,IAAI;YACxE,EAAE,EAAE,OAAO,CAAC,EAAE;SACf,CAAC,CAAC;QAEH,MAAM,EAAE,KAAK,EAAE,WAAW,EAAE,SAAS,EAAE,eAAe,EAAE,GAAG,MAAM,eAAe,CAC9E,OAAO,CAAC,iBAAiB,EACzB,qBAAqB,EACrB,MAAM,CAAC,MAAM,EACb,MAAM,CAAC,YAAY,CACpB,CAAC;QACF,KAAK,CAAC,SAAS,CAAC,iBAAiB,EAAE,IAAI,CAAC,KAAK,EAAE,oBAAoB,CAAC,sBAAsB,CAAC,CAAC,CAAC;QAC7F,OAAO,KAAK,CAAC,IAAI,CAAC,EAAE,WAAW,EAAE,oBAAoB,EAAE,eAAe,CAAC,WAAW,EAAE,EAAE,CAAC,CAAC;IAC1F,CAAC,CAAC,CAAC;IAEH;;;;;;;OAOG;IACH,OAAO,CAAC,IAAI,CAAC,GAAG,WAAW,SAAS,EAAE,KAAK,EAAE,OAAO,EAAE,KAAK,EAAE,EAAE;QAC7D,MAAM,KAAK,GAAG,OAAO,CAAC,OAAO,CAAC,iBAAiB,CAAC,CAAC;QACjD,IAAI,KAAK,EAAE,CAAC;YACV,MAAM,IAAI,GAAG,gBAAgB,CAAC,KAAK,CAAC,CAAC;YACrC,MAAM,MAAM,GAAG,MAAM,KAAK,CAAC,sBAAsB,CAAC,IAAI,CAAC,CAAC;YACxD,IAAI,MAAM,EAAE,CAAC;gBACX,MAAM,KAAK,CAAC,YAAY,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;gBAC1C,MAAM,UAAU,GAAG,MAAM,KAAK,CAAC,cAAc,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC;gBACnE,IAAI,UAAU,EAAE,eAAe,EAAE,CAAC;oBAChC,MAAM,IAAI,CAAC,cAAc,CAAC,UAAU,CAAC,eAAe,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;gBAC/E,CAAC;gBACD,MAAM,KAAK,CAAC,gBAAgB,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;YAC3E,CAAC;QACH,CAAC;QACD,KAAK,CAAC,WAAW,CAAC,iBAAiB,EAAE,EAAE,IAAI,EAAE,UAAU,EAAE,CAAC,CAAC;QAC3D,OAAO,KAAK,CAAC,IAAI,CAAC,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IACzC,CAAC,CAAC,CAAC;AACL,CAAC,CAAC;AAEF,MAAM,CAAC,MAAM,aAAa,GAAG,EAAE,CAAC,mBAAmB,EAAE;IACnD,IAAI,EAAE,yBAAyB;CAChC,CAAC,CAAC"}

package/dist/auth/tokens.d.ts

@@ -0,0 +1,24 @@
+export interface AccessTokenClaims {
+    /** flytedesk-id's `sub` — the token carries only the user id, never permissions. */
+    sub: string;
+    /** The IdpSession row id this session is backed by — loadAuthedUser (./plugin.ts)
+     *  needs it to call flytedesk-id's live authorization endpoint on every request. */
+    sid: string;
+}
+/**
+ * Bearer JWT this service issues to itself. Carries only `sub`/`sid` — never the
+ * permission set, or a role revoked in flytedesk-id would keep working here until the
+ * token expired instead of on the next authorization check.
+ */
+export declare function signAccessToken(secret: string, ttlSeconds: number, userId: string, sessionId: string): Promise<{
+    token: string;
+    expiresAt: Date;
+}>;
+export declare function verifyAccessToken(secret: string, token: string): Promise<AccessTokenClaims>;
+/** Opaque refresh token: random bytes handed to the browser as a cookie, only the hash
+ *  ever persisted server-side (via AuthStore#createRefreshToken). */
+export declare function generateRefreshToken(): {
+    token: string;
+    hash: string;
+};
+export declare function hashRefreshToken(token: string): string;

package/dist/auth/tokens.js

@@ -0,0 +1,35 @@
+import { randomBytes, createHash } from "node:crypto";
+import { SignJWT, jwtVerify } from "jose";
+/**
+ * Bearer JWT this service issues to itself. Carries only `sub`/`sid` — never the
+ * permission set, or a role revoked in flytedesk-id would keep working here until the
+ * token expired instead of on the next authorization check.
+ */
+export async function signAccessToken(secret, ttlSeconds, userId, sessionId) {
+    const key = new TextEncoder().encode(secret);
+    const expiresAt = new Date(Date.now() + ttlSeconds * 1000);
+    const token = await new SignJWT({ sub: userId, sid: sessionId })
+        .setProtectedHeader({ alg: "HS256" })
+        .setIssuedAt()
+        .setExpirationTime(Math.floor(expiresAt.getTime() / 1000))
+        .sign(key);
+    return { token, expiresAt };
+}
+export async function verifyAccessToken(secret, token) {
+    const key = new TextEncoder().encode(secret);
+    const { payload } = await jwtVerify(token, key, { algorithms: ["HS256"] });
+    if (typeof payload.sub !== "string" || typeof payload.sid !== "string") {
+        throw new Error("access token is missing the required sub/sid claims");
+    }
+    return { sub: payload.sub, sid: payload.sid };
+}
+/** Opaque refresh token: random bytes handed to the browser as a cookie, only the hash
+ *  ever persisted server-side (via AuthStore#createRefreshToken). */
+export function generateRefreshToken() {
+    const token = randomBytes(48).toString("base64url");
+    return { token, hash: hashRefreshToken(token) };
+}
+export function hashRefreshToken(token) {
+    return createHash("sha256").update(token).digest("hex");
+}
+//# sourceMappingURL=tokens.js.map

package/dist/auth/tokens.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"tokens.js","sourceRoot":"","sources":["../../src/auth/tokens.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,WAAW,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACtD,OAAO,EAAE,OAAO,EAAE,SAAS,EAAE,MAAM,MAAM,CAAC;AAU1C;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,eAAe,CACnC,MAAc,EACd,UAAkB,EAClB,MAAc,EACd,SAAiB;IAEjB,MAAM,GAAG,GAAG,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;IAC7C,MAAM,SAAS,GAAG,IAAI,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,UAAU,GAAG,IAAI,CAAC,CAAC;IAC3D,MAAM,KAAK,GAAG,MAAM,IAAI,OAAO,CAAC,EAAE,GAAG,EAAE,MAAM,EAAE,GAAG,EAAE,SAAS,EAAE,CAAC;SAC7D,kBAAkB,CAAC,EAAE,GAAG,EAAE,OAAO,EAAE,CAAC;SACpC,WAAW,EAAE;SACb,iBAAiB,CAAC,IAAI,CAAC,KAAK,CAAC,SAAS,CAAC,OAAO,EAAE,GAAG,IAAI,CAAC,CAAC;SACzD,IAAI,CAAC,GAAG,CAAC,CAAC;IACb,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,CAAC;AAC9B,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,iBAAiB,CAAC,MAAc,EAAE,KAAa;IACnE,MAAM,GAAG,GAAG,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;IAC7C,MAAM,EAAE,OAAO,EAAE,GAAG,MAAM,SAAS,CAAC,KAAK,EAAE,GAAG,EAAE,EAAE,UAAU,EAAE,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;IAC3E,IAAI,OAAO,OAAO,CAAC,GAAG,KAAK,QAAQ,IAAI,OAAO,OAAO,CAAC,GAAG,KAAK,QAAQ,EAAE,CAAC;QACvE,MAAM,IAAI,KAAK,CAAC,qDAAqD,CAAC,CAAC;IACzE,CAAC;IACD,OAAO,EAAE,GAAG,EAAE,OAAO,CAAC,GAAG,EAAE,GAAG,EAAE,OAAO,CAAC,GAAG,EAAE,CAAC;AAChD,CAAC;AAED;qEACqE;AACrE,MAAM,UAAU,oBAAoB;IAClC,MAAM,KAAK,GAAG,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;IACpD,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,gBAAgB,CAAC,KAAK,CAAC,EAAE,CAAC;AAClD,CAAC;AAED,MAAM,UAAU,gBAAgB,CAAC,KAAa;IAC5C,OAAO,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;AAC1D,CAAC"}

package/dist/auth/types.d.ts

@@ -0,0 +1,156 @@
+import type { FastifyRequest } from "fastify";
+/**
+ * Profile claims returned by flytedesk-id's userinfo endpoint (`GET {issuer}/me`).
+ * Deliberately does NOT include roles/permissions — those come from flytedesk-id's
+ * per-app authorization endpoint (see loadAuthedUser in ./plugin.ts), fetched live on
+ * every request rather than baked into a token, so a revoked role takes effect
+ * immediately instead of surviving until some token/cache expires.
+ */
+export interface UserinfoClaims {
+    /** flytedesk-id's subject id — the only user id any consuming app should key on. */
+    sub: string;
+    email: string;
+    emailVerified: boolean;
+    name?: string;
+}
+export interface IdpRole {
+    id: string;
+    key: string;
+    name: string;
+}
+/** What ends up on `request.authUser` for every authenticated request. */
+export interface AuthedUser {
+    id: string;
+    email: string;
+    name: string;
+    roles: IdpRole[];
+    /** Already stripped of the `${appId}:` prefix flytedesk-id's catalog uses to keep
+     *  permission keys collision-free across apps — see loadAuthedUser in ./plugin.ts. */
+    permissions: string[];
+    /** The IdpSession row id backing this session — the same value AuthStore rows key
+     *  refresh tokens to via `idpSessionId`. */
+    sessionId: string;
+}
+export interface RefreshTokenRow {
+    id: string;
+    /** Shared by every refresh token descended from the same login, via rotation.
+     *  Revoking a family (see revokeFamily below) is how reuse detection invalidates an
+     *  entire compromised chain in one call, not just the one token that got replayed. */
+    familyId: string;
+    userId: string;
+    idpSessionId: string;
+    revokedAt: Date | null;
+    expiresAt: Date;
+}
+export interface CreateRefreshTokenInput {
+    id: string;
+    familyId: string;
+    userId: string;
+    /** sha256 hex digest of the opaque refresh token — the raw token itself is never
+     *  persisted, only ever handed to the browser as a cookie. */
+    tokenHash: string;
+    expiresAt: Date;
+    idpSessionId: string;
+    userAgent: string | null;
+    ip: string;
+}
+export interface IdpSessionRow {
+    id: string;
+    subject: string;
+    name: string;
+    email: string;
+    idpAccessToken: string;
+    idpAccessTokenExpiresAt: Date;
+    idpRefreshToken: string | null;
+}
+export interface CreateIdpSessionInput {
+    subject: string;
+    name: string;
+    email: string;
+    idpAccessToken: string;
+    idpAccessTokenExpiresAt: Date;
+    idpRefreshToken: string | null;
+}
+export interface UpdateIdpSessionInput {
+    idpAccessToken?: string;
+    idpAccessTokenExpiresAt?: Date;
+    idpRefreshToken?: string | null;
+}
+/**
+ * Storage seam this package needs, and nothing more — kept ORM-agnostic (no Prisma
+ * import here) so a consumer can back it with whatever their own DB layer already is.
+ * The two "families" of rows below mirror media-planner's RefreshToken/IdpSession
+ * tables, which this module generalizes from (see DEC-38).
+ */
+export interface AuthStore {
+    createRefreshToken(row: CreateRefreshTokenInput): Promise<void>;
+    findRefreshTokenByHash(hash: string): Promise<RefreshTokenRow | null>;
+    /**
+     * MUST be implemented as a single atomic conditional update — e.g.
+     * `UPDATE refresh_tokens SET revoked_at = now() WHERE id = $1 AND revoked_at IS NULL`
+     * — returning whether THIS call was the one that actually revoked the row (true), as
+     * opposed to finding it already revoked (false, by a prior request or a concurrent
+     * one that won the race).
+     *
+     * This is the fix for a real race in the plugin's original find-then-revoke logic:
+     * two /refresh calls presenting the same still-valid token at the same instant could
+     * both read `revokedAt: null` before either write landed, both rotate successfully,
+     * and the replay would go undetected. A plain `find -> check -> revoke` sequence in
+     * the CALLER can't close this gap no matter how carefully it's written — the
+     * atomicity has to live in this one storage operation. Never implement this as a
+     * separate read followed by an unconditional write.
+     */
+    claimRefreshTokenForRotation(id: string): Promise<boolean>;
+    /** Reuse-detection path: revoke every row sharing this familyId. */
+    revokeFamily(familyId: string): Promise<void>;
+    createIdpSession(row: CreateIdpSessionInput): Promise<{
+        id: string;
+    }>;
+    findIdpSession(id: string): Promise<IdpSessionRow | null>;
+    updateIdpSession(id: string, patch: UpdateIdpSessionInput): Promise<void>;
+    deleteIdpSession(id: string): Promise<void>;
+}
+export interface FlytedeskAuthOptions {
+    /** This app's OAuth client_id, as registered with flytedesk-id. */
+    clientId: string;
+    /** Never sent to the browser — used once per callback, at the /token exchange. */
+    clientSecret: string;
+    /** flytedesk-id's base URL, e.g. "https://id.flytedesk.com". */
+    issuer: string;
+    redirectUri: string;
+    /** flytedesk-id's id for THIS app's authorization catalog — distinct from clientId:
+     *  it's what `GET {issuer}/apps/{appId}/authorization` and the permission-key prefix
+     *  (`${appId}:...`) key on. */
+    appId: string;
+    /** Where GET /callback redirects to once a session has been issued. */
+    postLoginRedirect: string;
+    /** Base path the four routes are mounted under. Default "/auth". */
+    routePrefix?: string;
+    /** Passed straight through to @fastify/cookie, which this plugin registers itself. */
+    cookieSecret: string | string[];
+    /** Gates the __Host- cookie prefix (requires Secure — see ./plugin.ts). Set false only
+     *  for local HTTP dev. */
+    secureCookies: boolean;
+    /** HS256 signing secret for this service's own short-lived access token. Never shared
+     *  with flytedesk-id or any other app. */
+    accessTokenSecret: string;
+    /** Default 900 (15 minutes). */
+    accessTokenTtlSeconds?: number;
+    /** Default 2_592_000 (30 days). */
+    refreshTokenTtlSeconds?: number;
+    /** Default 600 (10 minutes). */
+    loginAttemptTtlSeconds?: number;
+    /**
+     * Escape hatch: cache the flytedesk-id authorization lookup for this many ms instead
+     * of calling it live on every request. Default undefined/0 — live, uncached. Setting
+     * this weakens the "a revoked role takes effect immediately" guarantee by up to this
+     * many ms, so the plugin logs a startup warning naming the value rather than letting
+     * it take effect silently.
+     */
+    authorizationCacheTtlMs?: number;
+    store: AuthStore;
+    /** Called once per successful /callback, after profile verification and before the
+     *  session is issued — the hook for a consumer's own app-specific bookkeeping (e.g.
+     *  upserting a local profile row, checking a local suspension flag). */
+    onSignIn?: (profile: UserinfoClaims, request: FastifyRequest) => Promise<void> | void;
+}

package/dist/auth/types.js

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=types.js.map

package/dist/auth/types.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.js","sourceRoot":"","sources":["../../src/auth/types.ts"],"names":[],"mappings":""}

package/dist/cli/trace-sync.d.ts

@@ -0,0 +1,2 @@
+#!/usr/bin/env node
+export declare function main(argv: string[]): Promise<void>;