@fonderie/auth 6.0.0 → 7.0.0

package/dist/index.js

@@ -1704,7 +1704,10 @@ function authController(store, config, bus) {
             passwordHash,
             row.userId
           ]),
-          tx.query(`DELETE FROM fonderie_password_resets WHERE user_id = $1`, [row.userId])
+          tx.query(`DELETE FROM fonderie_password_resets WHERE user_id = $1`, [row.userId]),
+          // Revoke every session: the reset exists because the account may
+          // be compromised — a stolen session must not survive it.
+          tx.query(`DELETE FROM fonderie_sessions WHERE user_id = $1`, [row.userId])
         ]);
       });
       return setApiResponse3(HTTP3.OK, "PASSWORD_RESET_SUCCESSFUL", "Password reset successfully.");
@@ -2225,7 +2228,8 @@ function userController(store, config, bus) {
 }
 
 // src/controllers/oauth.controller.ts
-import { setApiResponse as setApiResponse5, HTTP as HTTP5 } from "@fonderie/core";
+import { randomBytes as randomBytes3 } from "crypto";
+import { setApiResponse as setApiResponse5, HTTP as HTTP5, constantTimeEqual as constantTimeEqual2 } from "@fonderie/core";
 function oauthController(store, config) {
   const users = new UserModel(store);
   const sessions = new SessionModel(store);
@@ -2240,18 +2244,30 @@ function oauthController(store, config) {
           "Google OAuth not configured"
         );
       }
+      const state = randomBytes3(16).toString("hex");
       const params = new URLSearchParams({
         client_id: google.clientId,
         redirect_uri: google.redirectUri,
         response_type: "code",
-        scope: "openid email profile"
+        scope: "openid email profile",
+        state
       });
       const url = `https://accounts.google.com/o/oauth2/v2/auth?${params}`;
-      return setApiResponse5(
-        HTTP5.OK,
-        "GOOGLE_AUTH_URL",
-        "Redirect the user to the returned URL to begin Google OAuth.",
-        { url }
+      const secure = config.secureCookies ?? process.env["NODE_ENV"] === "production" ? "; Secure" : "";
+      return Response.json(
+        {
+          reason: "GOOGLE_AUTH_URL",
+          explanation: "Redirect the user to the returned URL to begin Google OAuth.",
+          result: { url }
+        },
+        {
+          status: 200,
+          // SameSite=Lax (not Strict): the cookie must be sent on the
+          // top-level cross-site redirect back from Google.
+          headers: cookieHeaders([
+            `oauth_state=${state}; HttpOnly; SameSite=Lax; Path=/; Max-Age=600${secure}`
+          ])
+        }
       );
     },
     googleCallback: async (ctx) => {
@@ -2268,6 +2284,16 @@ function oauthController(store, config) {
       if (!code) {
         return setApiResponse5(HTTP5.BAD_REQUEST, "INVALID_PARAMETER", "Missing code");
       }
+      const returnedState = url.searchParams.get("state") ?? "";
+      const cookieHeader = ctx.request.headers.get("cookie") ?? "";
+      const expectedState = cookieHeader.match(/(?:^|;\s*)oauth_state=([^;]+)/)?.[1] ?? "";
+      if (!returnedState || !expectedState || !constantTimeEqual2(Buffer.from(returnedState), Buffer.from(expectedState))) {
+        return setApiResponse5(
+          HTTP5.BAD_REQUEST,
+          "GOOGLE_AUTH_FAILED",
+          "OAuth state mismatch \u2014 restart the sign-in flow"
+        );
+      }
       const tokenRes = await fetch("https://oauth2.googleapis.com/token", {
         method: "POST",
         headers: { "content-type": "application/x-www-form-urlencoded" },
@@ -2290,9 +2316,25 @@ function oauthController(store, config) {
       const payload = JSON.parse(
         Buffer.from(tokenData.id_token.split(".")[1] ?? "", "base64url").toString()
       );
+      if (payload.aud !== google.clientId) {
+        return setApiResponse5(HTTP5.BAD_REQUEST, "GOOGLE_AUTH_FAILED", "OAuth token audience mismatch");
+      }
+      if (payload.iss !== "https://accounts.google.com" && payload.iss !== "accounts.google.com") {
+        return setApiResponse5(HTTP5.BAD_REQUEST, "GOOGLE_AUTH_FAILED", "OAuth token issuer mismatch");
+      }
+      if (typeof payload.exp !== "number" || payload.exp * 1e3 < Date.now()) {
+        return setApiResponse5(HTTP5.BAD_REQUEST, "GOOGLE_AUTH_FAILED", "OAuth token expired");
+      }
       if (!payload.email) {
         return setApiResponse5(HTTP5.BAD_REQUEST, "GOOGLE_AUTH_FAILED", "No email in OAuth response");
       }
+      if (payload.email_verified !== true) {
+        return setApiResponse5(
+          HTTP5.BAD_REQUEST,
+          "GOOGLE_AUTH_FAILED",
+          "Google account email is not verified"
+        );
+      }
       const normalizedEmail = normalizeEmailSafe(payload.email);
       if (!normalizedEmail) {
         return setApiResponse5(HTTP5.BAD_REQUEST, "GOOGLE_AUTH_FAILED", "Invalid email in OAuth response");
@@ -2336,7 +2378,11 @@ function oauthController(store, config) {
         },
         {
           status: 200,
-          headers: cookieHeaders(tokenPairCookies(accessToken, refreshToken, config))
+          headers: cookieHeaders([
+            ...tokenPairCookies(accessToken, refreshToken, config),
+            // One-time value — clear it once the flow completes.
+            "oauth_state=; HttpOnly; SameSite=Lax; Path=/; Max-Age=0"
+          ])
         }
       );
     }