@fonoster/identity 0.26.0 → 0.30.0

package/dist/constants.js

@@ -1,6 +1,6 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.VERIFICATION_CODE_EXPIRATION = exports.SIGN_ALGORITHM = void 0;
+exports.REFRESH_TOKEN_REUSE_GRACE_MS = exports.SIGN_IN_FAILURE_LIMITS = exports.RESET_PASSWORD_ATTEMPT_LIMITS = exports.VERIFICATION_CODE_SEND_LIMITS = exports.VERIFICATION_CODE_MAX_ATTEMPTS = exports.VERIFICATION_CODE_EXPIRATION = exports.SIGN_ALGORITHM = void 0;
 /**
  * Copyright (C) 2025 by Fonoster Inc (https://fonoster.com)
  * http://github.com/fonoster/fonoster
@@ -21,3 +21,31 @@ exports.VERIFICATION_CODE_EXPIRATION = exports.SIGN_ALGORITHM = void 0;
  */
 exports.SIGN_ALGORITHM = "RS256";
 exports.VERIFICATION_CODE_EXPIRATION = 5 * 60 * 1000;
+/** Wrong guesses allowed before a code stops working. */
+exports.VERIFICATION_CODE_MAX_ATTEMPTS = 5;
+/** Codes sent per email, and per client IP, within the window. */
+exports.VERIFICATION_CODE_SEND_LIMITS = {
+    perEmail: 3,
+    perIp: 20,
+    windowMs: 10 * 60 * 1000
+};
+/** ResetPassword attempts per email, and per client IP, within the window. */
+exports.RESET_PASSWORD_ATTEMPT_LIMITS = {
+    perEmail: 10,
+    perIp: 30,
+    windowMs: 10 * 60 * 1000
+};
+/**
+ * Failed sign-ins (ExchangeCredentials, ExchangeVerificationCode) per email,
+ * and per client IP, before sign-in is refused for the rest of the window.
+ */
+exports.SIGN_IN_FAILURE_LIMITS = {
+    perEmail: 10,
+    perIp: 50,
+    windowMs: 15 * 60 * 1000
+};
+/**
+ * How long a just-used refresh token may be used again (concurrent renewals,
+ * e.g. two browser tabs). Later reuse revokes the token's family.
+ */
+exports.REFRESH_TOKEN_REUSE_GRACE_MS = 30 * 1000;

package/dist/exchanges/createExchangeApiKey.js

@@ -73,7 +73,10 @@ function createExchangeApiKey(prisma, identityConfig) {
         const { accessKeyId, accessKeySecret } = request;
         logger.verbose("call to exchangeApiKey", { accessKeyId });
         const key = yield (0, createGetApiKeyByAccessKeyId_1.createGetApiKeyByAccessKeyId)(prisma)(accessKeyId);
-        if ((key === null || key === void 0 ? void 0 : key.accessKeySecret) !== (accessKeySecret === null || accessKeySecret === void 0 ? void 0 : accessKeySecret.trim())) {
+        // An expired key gets the same answer as a wrong secret.
+        if (!key ||
+            key.accessKeySecret !== (accessKeySecret === null || accessKeySecret === void 0 ? void 0 : accessKeySecret.trim()) ||
+            (0, createGetApiKeyByAccessKeyId_1.isApiKeyExpired)(key)) {
             return callback({
                 code: grpc.status.PERMISSION_DENIED,
                 message: "Invalid credentials"

package/dist/exchanges/createExchangeCredentials.d.ts

@@ -18,8 +18,13 @@
  */
 import { GrpcErrorMessage } from "@fonoster/common";
 import { Prisma } from "../db";
+import { SignInThrottle } from "../utils/signInThrottle";
 import { IdentityConfig } from "./types";
-declare function createExchangeCredentials(prisma: Prisma, identityConfig: IdentityConfig): (call: {
+/**
+ * Password sign-in. Failed attempts are throttled per email and per client IP
+ * (see createSignInThrottle).
+ */
+declare function createExchangeCredentials(prisma: Prisma, identityConfig: IdentityConfig, throttle?: SignInThrottle): (call: {
     request: unknown;
 }, callback: (error?: import("@fonoster/common").GrpcErrorMessage, response?: unknown) => void) => Promise<void>;
 export { createExchangeCredentials };

package/dist/exchanges/createExchangeCredentials.js

@@ -64,19 +64,36 @@ exports.createExchangeCredentials = createExchangeCredentials;
 const common_1 = require("@fonoster/common");
 const logger_1 = require("@fonoster/logger");
 const grpc = __importStar(require("@grpc/grpc-js"));
+const authMethods_1 = require("../utils/authMethods");
+const clientAddress_1 = require("../utils/clientAddress");
 const createGetUserByEmail_1 = require("../utils/createGetUserByEmail");
 const createIsValidVerificationCode_1 = require("../utils/createIsValidVerificationCode");
+const signInThrottle_1 = require("../utils/signInThrottle");
+const userPasswords_1 = require("../utils/userPasswords");
 const verification_1 = require("../verification");
 const exchangeTokens_1 = require("./exchangeTokens");
 const logger = (0, logger_1.getLogger)({ service: "identity", filePath: __filename });
-function createExchangeCredentials(prisma, identityConfig) {
+/**
+ * Password sign-in. Failed attempts are throttled per email and per client IP
+ * (see createSignInThrottle).
+ */
+function createExchangeCredentials(prisma, identityConfig, throttle = (0, signInThrottle_1.createSignInThrottle)()) {
     const isValidVerificationCode = (0, createIsValidVerificationCode_1.createIsValidVerificationCode)(prisma);
+    const verifyUserPassword = (0, userPasswords_1.createVerifyUserPassword)(prisma);
     const exchangeCredentials = (call, callback) => __awaiter(this, void 0, void 0, function* () {
         const { request } = call;
         const { username: email, password, twoFactorCode } = request;
         logger.verbose("call to exchangeCredentials", { username: email });
+        if (!(0, authMethods_1.isMethodEnabled)(identityConfig, "password")) {
+            return callback((0, authMethods_1.methodDisabledError)("password"));
+        }
+        const ip = (0, clientAddress_1.clientAddress)(call);
+        if (throttle.isBlocked(email, ip)) {
+            return callback(signInThrottle_1.tooManySignInAttempts);
+        }
         const user = yield (0, createGetUserByEmail_1.createGetUserByEmail)(prisma)(email);
-        if (!user || user.password !== (password === null || password === void 0 ? void 0 : password.trim())) {
+        if (!user || !(yield verifyUserPassword(user, password === null || password === void 0 ? void 0 : password.trim()))) {
+            throttle.recordFailure(email, ip);
             return callback({
                 code: grpc.status.PERMISSION_DENIED,
                 message: "Invalid credentials"
@@ -91,6 +108,7 @@ function createExchangeCredentials(prisma, identityConfig) {
                 code: twoFactorCode
             });
             if (!isValid) {
+                throttle.recordFailure(email, ip);
                 return callback({
                     code: grpc.status.PERMISSION_DENIED,
                     message: "Invalid 2FA code"

package/dist/exchanges/createExchangeOauth2Code.js

@@ -64,21 +64,44 @@ exports.createExchangeOauth2Code = createExchangeOauth2Code;
 const common_1 = require("@fonoster/common");
 const logger_1 = require("@fonoster/logger");
 const grpc = __importStar(require("@grpc/grpc-js"));
-const createGetUserByEmail_1 = require("../utils/createGetUserByEmail");
+const createUserFromGitHub_1 = require("../users/createUserFromGitHub");
+const authMethods_1 = require("../utils/authMethods");
+const claimUnverifiedAccount_1 = require("../utils/claimUnverifiedAccount");
+const createGetUserByGitHubEmails_1 = require("../utils/createGetUserByGitHubEmails");
 const getGitHubUserWithOauth2Code_1 = require("../utils/getGitHubUserWithOauth2Code");
 const exchangeTokens_1 = require("./exchangeTokens");
 const logger = (0, logger_1.getLogger)({ service: "identity", filePath: __filename });
 function createExchangeOauth2Code(prisma, identityConfig) {
     const exchangeOauth2Code = (call, callback) => __awaiter(this, void 0, void 0, function* () {
+        var _a, _b;
         const { request } = call;
         const { provider, code } = request;
         logger.verbose("call to exchangeOauth2Code", { provider });
+        if (!(0, authMethods_1.isMethodEnabled)(identityConfig, "github") ||
+            !identityConfig.githubOauth2Config) {
+            return callback((0, authMethods_1.methodDisabledError)("github"));
+        }
         const userData = yield (0, getGitHubUserWithOauth2Code_1.getGitHubUserWithOauth2Code)({
             clientId: identityConfig.githubOauth2Config.clientId,
             clientSecret: identityConfig.githubOauth2Config.clientSecret,
+            url: identityConfig.githubOauth2Config.url,
+            apiUrl: identityConfig.githubOauth2Config.apiUrl,
             code
         });
-        const user = yield (0, createGetUserByEmail_1.createGetUserByEmail)(prisma)(userData.email);
+        if (!userData.email) {
+            return callback({
+                code: grpc.status.PERMISSION_DENIED,
+                message: "Your GitHub account has no verified primary email"
+            });
+        }
+        // First GitHub sign-in creates the account when sign-up is open; invited
+        // users already exist (the invite created them). GitHub verified the
+        // email, so an existing account whose email was never verified loses its
+        // password (M2).
+        const existing = yield (0, createGetUserByGitHubEmails_1.createGetUserByGitHubEmails)(prisma)((_a = userData.verifiedEmails) !== null && _a !== void 0 ? _a : [userData.email]);
+        const user = (_b = (existing && (yield (0, claimUnverifiedAccount_1.createClaimUnverifiedAccount)(prisma)(existing)))) !== null && _b !== void 0 ? _b : ((0, authMethods_1.isOpenSignup)(identityConfig)
+            ? yield (0, createUserFromGitHub_1.createUserFromGitHub)(prisma)(Object.assign(Object.assign({}, userData), { email: userData.email }))
+            : null);
         if (!user) {
             return callback({
                 code: grpc.status.PERMISSION_DENIED,

package/dist/exchanges/createExchangeRefreshToken.d.ts

@@ -19,7 +19,15 @@
 import { GrpcErrorMessage } from "@fonoster/common";
 import { Prisma } from "../db";
 import { IdentityConfig } from "./types";
+/**
+ * The claims of a refresh token this Identity issued (RS256, its issuer and
+ * audience, `tokenUse: "refresh"`, with a `jti`), or undefined.
+ */
+declare function verifyRefreshToken(token: string, identityConfig: IdentityConfig): {
+    jti: string;
+    accessKeyId: string;
+};
 declare function createExchangeRefreshToken(prisma: Prisma, identityConfig: IdentityConfig): (call: {
     request: unknown;
 }, callback: (error?: import("@fonoster/common").GrpcErrorMessage, response?: unknown) => void) => Promise<void>;
-export { createExchangeRefreshToken };
+export { createExchangeRefreshToken, verifyRefreshToken };

package/dist/exchanges/createExchangeRefreshToken.js

@@ -8,11 +8,9 @@ var __awaiter = (this && this.__awaiter) || function (thisArg, _arguments, P, ge
         step((generator = generator.apply(thisArg, _arguments || [])).next());
     });
 };
-var __importDefault = (this && this.__importDefault) || function (mod) {
-    return (mod && mod.__esModule) ? mod : { "default": mod };
-};
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.createExchangeRefreshToken = createExchangeRefreshToken;
+exports.verifyRefreshToken = verifyRefreshToken;
 /**
  * Copyright (C) 2025 by Fonoster Inc (https://fonoster.com)
  * http://github.com/fonoster/fonoster
@@ -33,21 +31,67 @@ exports.createExchangeRefreshToken = createExchangeRefreshToken;
  */
 const common_1 = require("@fonoster/common");
 const logger_1 = require("@fonoster/logger");
-const jsonwebtoken_1 = __importDefault(require("jsonwebtoken"));
-const constants_1 = require("../constants");
+const grpc_js_1 = require("@grpc/grpc-js");
+const createGetApiKeyByAccessKeyId_1 = require("../utils/createGetApiKeyByAccessKeyId");
 const exchangeTokens_1 = require("./exchangeTokens");
+const refreshTokens_1 = require("./refreshTokens");
 const logger = (0, logger_1.getLogger)({ service: "identity", filePath: __filename });
+const invalidRefreshToken = {
+    code: grpc_js_1.status.UNAUTHENTICATED,
+    message: "Invalid refresh token"
+};
+/**
+ * The claims of a refresh token this Identity issued (RS256, its issuer and
+ * audience, `tokenUse: "refresh"`, with a `jti`), or undefined.
+ */
+function verifyRefreshToken(token, identityConfig) {
+    const claims = (0, common_1.verifyToken)(token, identityConfig.publicKey, {
+        issuer: identityConfig.issuer,
+        audience: identityConfig.audience
+    });
+    if (!claims ||
+        claims.tokenUse !== common_1.TokenUseEnum.REFRESH ||
+        typeof claims.jti !== "string" ||
+        typeof claims.accessKeyId !== "string") {
+        return undefined;
+    }
+    return claims;
+}
 function createExchangeRefreshToken(prisma, identityConfig) {
+    const refreshTokens = (0, refreshTokens_1.createRefreshTokenStore)(prisma);
+    const getApiKey = (0, createGetApiKeyByAccessKeyId_1.createGetApiKeyByAccessKeyId)(prisma);
+    /** The user or API key still exists (and the key hasn't expired). */
+    const principalIsActive = (accessKeyId) => __awaiter(this, void 0, void 0, function* () {
+        if (accessKeyId.startsWith("US")) {
+            return (yield prisma.user.findFirst({ where: { accessKeyId } })) !== null;
+        }
+        const key = yield getApiKey(accessKeyId);
+        return key !== null && !(0, createGetApiKeyByAccessKeyId_1.isApiKeyExpired)(key);
+    });
     const exchangeRefreshToken = (call, callback) => __awaiter(this, void 0, void 0, function* () {
-        const { privateKey } = identityConfig;
-        const { request } = call;
-        const { refreshToken: oldRefreshToken } = request;
-        const oldRefreshTokenDecoded = jsonwebtoken_1.default.verify(oldRefreshToken, privateKey, {
-            algorithms: [constants_1.SIGN_ALGORITHM]
-        });
-        const { accessKeyId } = oldRefreshTokenDecoded;
+        const claims = verifyRefreshToken(call.request.refreshToken, identityConfig);
+        if (!claims) {
+            return callback(invalidRefreshToken);
+        }
+        const { jti, accessKeyId } = claims;
         logger.verbose("call to exchangeRefreshToken", { accessKeyId });
-        callback(null, yield (0, exchangeTokens_1.exchangeTokens)(prisma, identityConfig)(accessKeyId));
+        // Single use: a token seen before (or revoked) revokes its whole family.
+        const consumed = yield refreshTokens.consume(jti);
+        if (consumed.status !== "ok" || consumed.accessKeyId !== accessKeyId) {
+            if (consumed.status === "reused") {
+                logger.warn("refresh token reused; its family is revoked", {
+                    accessKeyId
+                });
+            }
+            return callback(invalidRefreshToken);
+        }
+        if (!(yield principalIsActive(accessKeyId))) {
+            yield refreshTokens.revokeFamily(consumed.familyId);
+            return callback(invalidRefreshToken);
+        }
+        callback(null, yield (0, exchangeTokens_1.exchangeTokens)(prisma, identityConfig)(accessKeyId, {
+            familyId: consumed.familyId
+        }));
     });
     return (0, common_1.withErrorHandlingAndValidation)(exchangeRefreshToken, common_1.exchangeRefreshTokenRequestSchema);
 }

package/dist/exchanges/createExchangeVerificationCode.d.ts

@@ -0,0 +1,35 @@
+/**
+ * Copyright (C) 2025 by Fonoster Inc (https://fonoster.com)
+ * http://github.com/fonoster/fonoster
+ *
+ * This file is part of Fonoster
+ *
+ * Licensed under the MIT License (the "License");
+ * you may not use this file except in compliance with
+ * the License. You may obtain a copy of the License at
+ *
+ *    https://opensource.org/licenses/MIT
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+import { GrpcErrorMessage } from "@fonoster/common";
+import { Prisma } from "../db";
+import { SignInThrottle } from "../utils/signInThrottle";
+import { IdentityConfig } from "./types";
+type ExchangeVerificationCodeRequest = {
+    email: string;
+    code: string;
+};
+/**
+ * Passwordless sign-in: trades the code from SendVerificationCode for tokens.
+ * The first sign-in creates the account when sign-up is open; with invite-only
+ * sign-up, unknown emails get the same error as a wrong code.
+ */
+declare function createExchangeVerificationCode(prisma: Prisma, identityConfig: IdentityConfig, throttle?: SignInThrottle): (call: {
+    request: unknown;
+}, callback: (error?: import("@fonoster/common").GrpcErrorMessage, response?: unknown) => void) => Promise<void>;
+export { createExchangeVerificationCode, ExchangeVerificationCodeRequest };

package/dist/exchanges/createExchangeVerificationCode.js

@@ -0,0 +1,95 @@
+"use strict";
+var __awaiter = (this && this.__awaiter) || function (thisArg, _arguments, P, generator) {
+    function adopt(value) { return value instanceof P ? value : new P(function (resolve) { resolve(value); }); }
+    return new (P || (P = Promise))(function (resolve, reject) {
+        function fulfilled(value) { try { step(generator.next(value)); } catch (e) { reject(e); } }
+        function rejected(value) { try { step(generator["throw"](value)); } catch (e) { reject(e); } }
+        function step(result) { result.done ? resolve(result.value) : adopt(result.value).then(fulfilled, rejected); }
+        step((generator = generator.apply(thisArg, _arguments || [])).next());
+    });
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.createExchangeVerificationCode = createExchangeVerificationCode;
+/**
+ * Copyright (C) 2025 by Fonoster Inc (https://fonoster.com)
+ * http://github.com/fonoster/fonoster
+ *
+ * This file is part of Fonoster
+ *
+ * Licensed under the MIT License (the "License");
+ * you may not use this file except in compliance with
+ * the License. You may obtain a copy of the License at
+ *
+ *    https://opensource.org/licenses/MIT
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+const common_1 = require("@fonoster/common");
+const logger_1 = require("@fonoster/logger");
+const grpc_js_1 = require("@grpc/grpc-js");
+const authMethods_1 = require("../utils/authMethods");
+const claimUnverifiedAccount_1 = require("../utils/claimUnverifiedAccount");
+const clientAddress_1 = require("../utils/clientAddress");
+const createGetUserByEmail_1 = require("../utils/createGetUserByEmail");
+const createIsValidVerificationCode_1 = require("../utils/createIsValidVerificationCode");
+const generateAccessKeyId_1 = require("../utils/generateAccessKeyId");
+const signInThrottle_1 = require("../utils/signInThrottle");
+const types_1 = require("../verification/types");
+const exchangeTokens_1 = require("./exchangeTokens");
+const logger = (0, logger_1.getLogger)({ service: "identity", filePath: __filename });
+const invalidCode = {
+    code: grpc_js_1.status.PERMISSION_DENIED,
+    message: "Invalid verification code"
+};
+/**
+ * Passwordless sign-in: trades the code from SendVerificationCode for tokens.
+ * The first sign-in creates the account when sign-up is open; with invite-only
+ * sign-up, unknown emails get the same error as a wrong code.
+ */
+function createExchangeVerificationCode(prisma, identityConfig, throttle = (0, signInThrottle_1.createSignInThrottle)()) {
+    const isValidVerificationCode = (0, createIsValidVerificationCode_1.createIsValidVerificationCode)(prisma);
+    const getUserByEmail = (0, createGetUserByEmail_1.createGetUserByEmail)(prisma);
+    const claimUnverifiedAccount = (0, claimUnverifiedAccount_1.createClaimUnverifiedAccount)(prisma);
+    const exchangeVerificationCode = (call, callback) => __awaiter(this, void 0, void 0, function* () {
+        const email = call.request.email.trim().toLowerCase();
+        logger.verbose("call to exchangeVerificationCode", { email });
+        if (!(0, authMethods_1.isMethodEnabled)(identityConfig, "email_code")) {
+            return callback((0, authMethods_1.methodDisabledError)("email_code"));
+        }
+        const ip = (0, clientAddress_1.clientAddress)(call);
+        if (throttle.isBlocked(email, ip)) {
+            return callback(signInThrottle_1.tooManySignInAttempts);
+        }
+        const isValid = yield isValidVerificationCode({
+            type: types_1.ContactType.EMAIL,
+            value: email,
+            code: call.request.code
+        });
+        if (!isValid) {
+            throttle.recordFailure(email, ip);
+            return callback(invalidCode);
+        }
+        const existing = yield getUserByEmail(email);
+        if (!existing && !(0, authMethods_1.isOpenSignup)(identityConfig)) {
+            return callback(invalidCode);
+        }
+        // The code proves the address, so the email is verified either way. An
+        // account whose email was never verified loses its password (M2).
+        const user = existing
+            ? yield claimUnverifiedAccount(existing)
+            : yield prisma.user.create({
+                data: {
+                    name: email.split("@")[0].slice(0, 60),
+                    email,
+                    emailVerified: true,
+                    accessKeyId: (0, generateAccessKeyId_1.generateAccessKeyId)(generateAccessKeyId_1.AccessKeyIdType.USER)
+                }
+            });
+        callback(null, yield (0, exchangeTokens_1.exchangeTokens)(prisma, identityConfig)(user.accessKeyId));
+    });
+    return (0, common_1.withErrorHandlingAndValidation)(exchangeVerificationCode, common_1.Validators.exchangeVerificationCodeRequestSchema);
+}

package/dist/exchanges/createRevokeToken.d.ts

@@ -0,0 +1,33 @@
+/**
+ * Copyright (C) 2025 by Fonoster Inc (https://fonoster.com)
+ * http://github.com/fonoster/fonoster
+ *
+ * This file is part of Fonoster
+ *
+ * Licensed under the MIT License (the "License");
+ * you may not use this file except in compliance with
+ * the License. You may obtain a copy of the License at
+ *
+ *    https://opensource.org/licenses/MIT
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+import { GrpcErrorMessage } from "@fonoster/common";
+import { Prisma } from "../db";
+import { IdentityConfig } from "./types";
+type RevokeTokenRequest = {
+    token: string;
+};
+/**
+ * Sign-out: revokes the refresh token and every token rotated from the same
+ * sign-in. Holding the refresh token is the authorization, so the method is
+ * public. Access tokens already issued stay valid until they expire.
+ */
+declare function createRevokeToken(prisma: Prisma, identityConfig: IdentityConfig): (call: {
+    request: unknown;
+}, callback: (error?: import("@fonoster/common").GrpcErrorMessage, response?: unknown) => void) => Promise<void>;
+export { createRevokeToken, RevokeTokenRequest };

package/dist/exchanges/createRevokeToken.js

@@ -0,0 +1,64 @@
+"use strict";
+var __awaiter = (this && this.__awaiter) || function (thisArg, _arguments, P, generator) {
+    function adopt(value) { return value instanceof P ? value : new P(function (resolve) { resolve(value); }); }
+    return new (P || (P = Promise))(function (resolve, reject) {
+        function fulfilled(value) { try { step(generator.next(value)); } catch (e) { reject(e); } }
+        function rejected(value) { try { step(generator["throw"](value)); } catch (e) { reject(e); } }
+        function step(result) { result.done ? resolve(result.value) : adopt(result.value).then(fulfilled, rejected); }
+        step((generator = generator.apply(thisArg, _arguments || [])).next());
+    });
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.createRevokeToken = createRevokeToken;
+/**
+ * Copyright (C) 2025 by Fonoster Inc (https://fonoster.com)
+ * http://github.com/fonoster/fonoster
+ *
+ * This file is part of Fonoster
+ *
+ * Licensed under the MIT License (the "License");
+ * you may not use this file except in compliance with
+ * the License. You may obtain a copy of the License at
+ *
+ *    https://opensource.org/licenses/MIT
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+const common_1 = require("@fonoster/common");
+const logger_1 = require("@fonoster/logger");
+const grpc_js_1 = require("@grpc/grpc-js");
+const createExchangeRefreshToken_1 = require("./createExchangeRefreshToken");
+const refreshTokens_1 = require("./refreshTokens");
+const logger = (0, logger_1.getLogger)({ service: "identity", filePath: __filename });
+/**
+ * Sign-out: revokes the refresh token and every token rotated from the same
+ * sign-in. Holding the refresh token is the authorization, so the method is
+ * public. Access tokens already issued stay valid until they expire.
+ */
+function createRevokeToken(prisma, identityConfig) {
+    const refreshTokens = (0, refreshTokens_1.createRefreshTokenStore)(prisma);
+    const revokeToken = (call, callback) => __awaiter(this, void 0, void 0, function* () {
+        const claims = (0, createExchangeRefreshToken_1.verifyRefreshToken)(call.request.token, identityConfig);
+        if (!claims) {
+            return callback({
+                code: grpc_js_1.status.UNAUTHENTICATED,
+                message: "Invalid refresh token"
+            });
+        }
+        const row = yield prisma.refreshToken.findUnique({
+            where: { jti: claims.jti }
+        });
+        if (row) {
+            yield refreshTokens.revokeFamily(row.familyId);
+        }
+        logger.verbose("refresh token revoked", {
+            accessKeyId: claims.accessKeyId
+        });
+        callback(null, { token: claims.jti });
+    });
+    return (0, common_1.withErrorHandlingAndValidation)(revokeToken, common_1.Validators.revokeTokenRequestSchema);
+}

package/dist/exchanges/exchangeTokens.d.ts

@@ -1,6 +1,8 @@
 import { Prisma } from "../db";
 import { IdentityConfig } from "./types";
-declare function exchangeTokens(prisma: Prisma, identityConfig: IdentityConfig): (accessKeyId: string) => Promise<{
+declare function exchangeTokens(prisma: Prisma, identityConfig: IdentityConfig): (accessKeyId: string, options?: {
+    familyId?: string;
+}) => Promise<{
     idToken: any;
     accessToken: any;
     refreshToken: any;

package/dist/exchanges/exchangeTokens.js

@@ -64,17 +64,28 @@ exports.exchangeTokens = exchangeTokens;
  * See the License for the specific language governing permissions and
  * limitations under the License.
  */
+const crypto_1 = require("crypto");
 const jsonwebtoken_1 = __importDefault(require("jsonwebtoken"));
+const constants_1 = require("../constants");
 const AK = __importStar(require("./payloads/apikeys"));
 const US = __importStar(require("./payloads/users"));
-const SIGN_ALGORITHM = "RS256";
+const refreshTokens_1 = require("./refreshTokens");
 // prettier-ignore
 function exchangeTokens(prisma, identityConfig) {
-    return (accessKeyId) => __awaiter(this, void 0, void 0, function* () {
+    const refreshTokens = (0, refreshTokens_1.createRefreshTokenStore)(prisma);
+    /**
+     * Issues tokens for `accessKeyId`. The refresh token gets a fresh `jti`,
+     * recorded so it can be used once; `familyId` continues a rotation chain
+     * (absent for a new sign-in).
+     */
+    return (accessKeyId_1, ...args_1) => __awaiter(this, [accessKeyId_1, ...args_1], void 0, function* (accessKeyId, options = {}) {
+        var _a;
         const { privateKey, idTokenExpiresIn, accessTokenExpiresIn, refreshTokenExpiresIn } = identityConfig;
-        const idTokenSignOptions = { algorithm: SIGN_ALGORITHM, expiresIn: idTokenExpiresIn };
-        const accessTokenSignOptions = { algorithm: SIGN_ALGORITHM, expiresIn: accessTokenExpiresIn };
-        const refreshTokenSignOptions = { algorithm: SIGN_ALGORITHM, expiresIn: refreshTokenExpiresIn };
+        const jti = (0, crypto_1.randomUUID)();
+        const familyId = (_a = options.familyId) !== null && _a !== void 0 ? _a : (0, crypto_1.randomUUID)();
+        const idTokenSignOptions = { algorithm: constants_1.SIGN_ALGORITHM, expiresIn: idTokenExpiresIn };
+        const accessTokenSignOptions = { algorithm: constants_1.SIGN_ALGORITHM, expiresIn: accessTokenExpiresIn };
+        const refreshTokenSignOptions = { algorithm: constants_1.SIGN_ALGORITHM, expiresIn: refreshTokenExpiresIn, jwtid: jti };
         let idToken = null;
         let accessToken = null;
         let refreshToken = null;
@@ -92,6 +103,13 @@ function exchangeTokens(prisma, identityConfig) {
             accessToken = jsonwebtoken_1.default.sign(accessTokenPayload, privateKey, accessTokenSignOptions);
             refreshToken = jsonwebtoken_1.default.sign(refreshTokenPayload, privateKey, refreshTokenSignOptions);
         }
+        const { exp } = jsonwebtoken_1.default.decode(refreshToken);
+        yield refreshTokens.record({
+            jti,
+            familyId,
+            accessKeyId,
+            expiresAt: new Date(exp * 1000)
+        });
         return {
             idToken,
             accessToken,

package/dist/exchanges/index.d.ts

@@ -20,4 +20,6 @@ export * from "./createExchangeApiKey";
 export * from "./createExchangeCredentials";
 export * from "./createExchangeOauth2Code";
 export * from "./createExchangeRefreshToken";
+export * from "./createExchangeVerificationCode";
+export * from "./createRevokeToken";
 export * from "./types";

package/dist/exchanges/index.js

@@ -36,4 +36,6 @@ __exportStar(require("./createExchangeApiKey"), exports);
 __exportStar(require("./createExchangeCredentials"), exports);
 __exportStar(require("./createExchangeOauth2Code"), exports);
 __exportStar(require("./createExchangeRefreshToken"), exports);
+__exportStar(require("./createExchangeVerificationCode"), exports);
+__exportStar(require("./createRevokeToken"), exports);
 __exportStar(require("./types"), exports);

package/dist/exchanges/payloads/users/createGetIdTokenPayload.js

@@ -41,7 +41,7 @@ function createGetIdTokenPayload(prisma, identityConfig) {
                 return null;
             }
             const { issuer, audience } = identityConfig;
-            const { ref, email, phoneNumber, emailVerified, phoneNumberVerified } = user;
+            const { ref, email, phoneNumber, emailVerified, phoneNumberVerified, mustChangePassword } = user;
             return {
                 iss: issuer,
                 sub: ref,
@@ -51,7 +51,8 @@ function createGetIdTokenPayload(prisma, identityConfig) {
                 email,
                 emailVerified,
                 phoneNumber,
-                phoneNumberVerified
+                phoneNumberVerified,
+                mustChangePassword
             };
         });
     };

package/dist/exchanges/refreshTokens.d.ts

@@ -0,0 +1,30 @@
+import { Prisma } from "../db";
+type ConsumeResult = {
+    status: "ok";
+    familyId: string;
+    accessKeyId: string;
+} | {
+    status: "reused" | "unknown";
+};
+/**
+ * Issued refresh tokens, by `jti`. A token is good for one exchange: using it
+ * marks it used and the exchange issues the next token in the same family. A
+ * token presented again (or after revocation) revokes the whole family, so a
+ * stolen token stops working for the thief and the owner alike. A token used
+ * moments ago (REFRESH_TOKEN_REUSE_GRACE_MS) may be used again, so two tabs
+ * renewing the same session at once don't sign each other out.
+ */
+declare function createRefreshTokenStore(prisma: Prisma): {
+    record(token: {
+        jti: string;
+        familyId: string;
+        accessKeyId: string;
+        expiresAt: Date;
+    }): Promise<void>;
+    /** Marks `jti` used, once. A second use revokes its family. */
+    consume(jti: string): Promise<ConsumeResult>;
+    revokeFamily(familyId: string): Promise<void>;
+    /** Signs a user or API key out everywhere (password reset, key rotation). */
+    revokeAll(accessKeyId: string): Promise<void>;
+};
+export { createRefreshTokenStore };