@getstrata/core 1.0.9 → 1.1.0

package/dist/entries/auth/oauth/oidcProvider.js

@@ -1,5 +1,493 @@
 // @bun
 // ../../src/core/auth/oauth/oidcProvider.ts
+import { createHash as createHash2, randomBytes } from "crypto";
+
+// ../../src/core/runtime/appEnv.ts
+var NON_PRODUCTION_APP_ENVS = new Set(["local", "development", "dev", "test", "testing", "ci"]);
+function normalizeEnvValue(value) {
+  return (value ?? "").trim().toLowerCase();
+}
+function isProductionEnv(env = process.env) {
+  const appEnv = normalizeEnvValue(env.APP_ENV);
+  const nodeEnv = normalizeEnvValue(env.NODE_ENV);
+  if (appEnv === "production" || nodeEnv === "production") {
+    return true;
+  }
+  if (appEnv === "") {
+    return false;
+  }
+  return !NON_PRODUCTION_APP_ENVS.has(appEnv);
+}
+function envFlagEnabled(value) {
+  return value === "true";
+}
+
+// ../../src/core/security/safeUrl.ts
+import { lookup as dnsLookupImpl } from "dns/promises";
+import { BadRequestError } from "@getstrata/core/errors/http";
+var dnsLookup = dnsLookupImpl;
+var BLOCKED_HOSTNAMES = new Set([
+  "localhost",
+  "127.0.0.1",
+  "0.0.0.0",
+  "::1",
+  "metadata.google.internal"
+]);
+function parseCanonicalDottedDecimal(hostname) {
+  const parts = hostname.split(".");
+  if (parts.length !== 4) {
+    return null;
+  }
+  const octets = [];
+  for (const part of parts) {
+    if (!/^(0|[1-9]\d{0,2})$/u.test(part)) {
+      return null;
+    }
+    const value = Number.parseInt(part, 10);
+    if (!Number.isInteger(value) || value < 0 || value > 255) {
+      return null;
+    }
+    octets.push(value);
+  }
+  return octets;
+}
+function parseDottedIpv4(hostname) {
+  return parseCanonicalDottedDecimal(hostname);
+}
+function isBlockedIpv4Octets(octets) {
+  const [a = 0, b = 0] = octets;
+  if (a === 10 || a === 127 || a === 0) {
+    return true;
+  }
+  if (a === 169 && b === 254) {
+    return true;
+  }
+  if (a === 172 && b >= 16 && b <= 31) {
+    return true;
+  }
+  if (a === 192 && b === 168) {
+    return true;
+  }
+  if (a === 100 && b >= 64 && b <= 127) {
+    return true;
+  }
+  if (a === 198 && (b === 18 || b === 19)) {
+    return true;
+  }
+  return false;
+}
+function expandIpv6(hostname) {
+  const trimmed = hostname.trim().toLowerCase();
+  const unbracketed = trimmed.startsWith("[") && trimmed.endsWith("]") ? trimmed.slice(1, -1) : trimmed;
+  if (unbracketed.includes("%")) {
+    return null;
+  }
+  const mapped = unbracketed.match(/^::ffff:([0-9a-fx.]+)$/iu);
+  if (mapped?.[1]) {
+    const octets = parseDottedIpv4(mapped[1]);
+    if (!octets) {
+      return null;
+    }
+    return [
+      0,
+      0,
+      0,
+      0,
+      0,
+      65535,
+      octets[0] << 8 | octets[1],
+      octets[2] << 8 | octets[3]
+    ];
+  }
+  const halves = unbracketed.split("::");
+  if (halves.length > 2) {
+    return null;
+  }
+  const parseGroup = (part) => {
+    if (!/^[0-9a-f]{1,4}$/u.test(part)) {
+      return null;
+    }
+    return Number.parseInt(part, 16);
+  };
+  if (halves.length === 1) {
+    const groups = unbracketed.split(":");
+    if (groups.length !== 8) {
+      return null;
+    }
+    const values = groups.map(parseGroup);
+    return values.every((value) => value !== null) ? values : null;
+  }
+  const head = halves[0] ? halves[0].split(":").filter(Boolean) : [];
+  const tail = halves[1] ? halves[1].split(":").filter(Boolean) : [];
+  if (head.length + tail.length > 8) {
+    return null;
+  }
+  const values = [];
+  for (const part of head) {
+    const value = parseGroup(part);
+    if (value === null) {
+      return null;
+    }
+    values.push(value);
+  }
+  while (values.length < 8 - tail.length) {
+    values.push(0);
+  }
+  for (const part of tail) {
+    const value = parseGroup(part);
+    if (value === null) {
+      return null;
+    }
+    values.push(value);
+  }
+  return values.length === 8 ? values : null;
+}
+function isBlockedIpv6(hostname) {
+  const groups = expandIpv6(hostname);
+  if (!groups) {
+    return hostname.includes(":");
+  }
+  const first = groups[0] ?? 0;
+  const second = groups[1] ?? 0;
+  if (groups.every((group) => group === 0)) {
+    return true;
+  }
+  if (groups.slice(0, 7).every((group) => group === 0) && groups[7] === 1) {
+    return true;
+  }
+  if ((first & 65472) === 65152) {
+    return true;
+  }
+  if ((first & 65024) === 64512) {
+    return true;
+  }
+  if ((first & 65280) === 65280) {
+    return true;
+  }
+  if (first === 0 && second === 0 && groups[2] === 0 && groups[3] === 0 && groups[4] === 0 && groups[5] === 65535) {
+    const a = (groups[6] ?? 0) >> 8;
+    const b = (groups[6] ?? 0) & 255;
+    const c = (groups[7] ?? 0) >> 8;
+    const d = (groups[7] ?? 0) & 255;
+    return isBlockedIpv4Octets([a, b, c, d]);
+  }
+  return false;
+}
+function isBlockedHostname(hostname) {
+  const normalized = hostname.trim().toLowerCase();
+  if (normalized.length === 0) {
+    return true;
+  }
+  if (BLOCKED_HOSTNAMES.has(normalized)) {
+    return true;
+  }
+  if (normalized.endsWith(".local") || normalized.endsWith(".internal")) {
+    return true;
+  }
+  if (normalized.includes(":")) {
+    return isBlockedIpv6(normalized);
+  }
+  if (/^\d+$/u.test(normalized)) {
+    return true;
+  }
+  if (normalized.includes(".")) {
+    const canonical = parseCanonicalDottedDecimal(normalized);
+    if (canonical) {
+      return isBlockedIpv4Octets(canonical);
+    }
+    if (/^[0-9a-fx.]+$/iu.test(normalized)) {
+      return true;
+    }
+  }
+  return false;
+}
+function productionSafeOutboundOptions(options) {
+  if (!isProductionEnv()) {
+    return options;
+  }
+  return { ...options, allowPrivate: false, resolveDns: true };
+}
+function assertSafeOutboundUrl(rawUrl, options = {}) {
+  const resolved = productionSafeOutboundOptions(options);
+  let parsed;
+  try {
+    parsed = new URL(rawUrl);
+  } catch {
+    throw new BadRequestError("Webhook URL is invalid.");
+  }
+  if (parsed.protocol !== "https:" && !(resolved.allowHttp && parsed.protocol === "http:")) {
+    throw new BadRequestError("Webhook URL must use HTTPS.");
+  }
+  if (parsed.username || parsed.password) {
+    throw new BadRequestError("Webhook URL must not include credentials.");
+  }
+  if (!resolved.allowPrivate && isBlockedHostname(parsed.hostname)) {
+    throw new BadRequestError("Webhook URL targets a blocked host.");
+  }
+  return parsed;
+}
+function isBlockedIpAddress(address) {
+  return isBlockedHostname(address.trim().toLowerCase());
+}
+function isLiteralIpHostname(hostname) {
+  return parseCanonicalDottedDecimal(hostname) !== null || expandIpv6(hostname) !== null;
+}
+function pinUrlToAddress(url, address) {
+  const pinned = new URL(url.toString());
+  const ipv6 = expandIpv6(address.replace(/^\[|\]$/gu, ""));
+  pinned.hostname = ipv6 ? `[${address.replace(/^\[|\]$/gu, "")}]` : address;
+  return pinned;
+}
+async function resolveSafeOutboundTarget(rawUrl, options = {}) {
+  const resolvedOptions = productionSafeOutboundOptions(options);
+  const parsed = assertSafeOutboundUrl(rawUrl, resolvedOptions);
+  if (resolvedOptions.resolveDns === false || resolvedOptions.allowPrivate) {
+    return { url: parsed, addresses: [] };
+  }
+  const hostname = parsed.hostname.trim().toLowerCase();
+  if (isLiteralIpHostname(hostname)) {
+    return { url: parsed, addresses: [hostname] };
+  }
+  let results;
+  try {
+    results = await dnsLookup(hostname, { all: true, verbatim: true });
+  } catch {
+    throw new BadRequestError("Webhook URL targets a blocked host.");
+  }
+  if (results.length === 0 || results.some((result) => isBlockedIpAddress(result.address))) {
+    throw new BadRequestError("Webhook URL targets a blocked host.");
+  }
+  return { url: parsed, addresses: results.map((result) => result.address) };
+}
+
+// ../../src/core/security/safeFetch.ts
+var DEFAULT_FETCH_TIMEOUT_MS = 1e4;
+async function safeFetch(input, init = {}, options = {}) {
+  const timeoutMs = options.timeoutMs ?? DEFAULT_FETCH_TIMEOUT_MS;
+  const maxRedirects = options.maxRedirects ?? 0;
+  const resolveDns = options.resolveDns ?? true;
+  const urlOptions = {
+    allowHttp: options.allowHttp,
+    resolveDns,
+    allowPrivate: options.allowPrivate
+  };
+  const controller = new AbortController;
+  const timeout = setTimeout(() => controller.abort(), timeoutMs);
+  try {
+    let current = await resolveSafeOutboundTarget(input, urlOptions);
+    let redirectCount = 0;
+    while (true) {
+      const address = current.addresses[0];
+      const fetchUrl = address ? pinUrlToAddress(current.url, address).toString() : current.url.toString();
+      const headers = new Headers(init.headers);
+      if (address && !headers.has("host")) {
+        headers.set("Host", current.url.host);
+      }
+      const fetchInit = {
+        ...init,
+        headers,
+        signal: controller.signal,
+        redirect: "manual"
+      };
+      if (address) {
+        fetchInit.tls = { serverName: current.url.hostname };
+      }
+      const response = await fetch(fetchUrl, fetchInit);
+      if (response.status >= 300 && response.status < 400) {
+        const location = response.headers.get("location");
+        if (!location || redirectCount >= maxRedirects) {
+          return response;
+        }
+        current = await resolveSafeOutboundTarget(new URL(location, current.url).toString(), urlOptions);
+        redirectCount += 1;
+        continue;
+      }
+      return response;
+    }
+  } finally {
+    clearTimeout(timeout);
+  }
+}
+
+// ../../src/core/auth/oauth/oidcIdToken.ts
+import { createHash, createPublicKey, createVerify } from "crypto";
+
+// ../../src/core/security/timingSafeCompare.ts
+import { timingSafeEqual } from "crypto";
+function timingSafeCompareString(left, right) {
+  const leftBuffer = Buffer.from(left);
+  const rightBuffer = Buffer.from(right);
+  if (leftBuffer.length !== rightBuffer.length) {
+    return false;
+  }
+  return timingSafeEqual(leftBuffer, rightBuffer);
+}
+
+// ../../src/core/auth/oauth/oidcIdToken.ts
+var JWKS_TTL_MS = 60 * 60 * 1000;
+var discoveryCache = new Map;
+var jwksCache = new Map;
+function issuerOrigin(issuer) {
+  return issuer.replace(/\/$/, "");
+}
+async function fetchJson(url) {
+  const response = await safeFetch(url, { headers: { accept: "application/json" } }, { allowHttp: !isProductionEnv(), timeoutMs: 1e4, maxRedirects: 0 });
+  return await response.json();
+}
+async function loadOidcDiscovery(issuer) {
+  const key = issuerOrigin(issuer);
+  const cached = discoveryCache.get(key);
+  if (cached && Date.now() - cached.fetchedAt < JWKS_TTL_MS) {
+    return cached.discovery;
+  }
+  const discovery = await fetchJson(`${key}/.well-known/openid-configuration`);
+  if (!discovery?.authorization_endpoint?.trim() || !discovery.jwks_uri?.trim() || !discovery.token_endpoint?.trim()) {
+    throw new Error("OIDC discovery document did not include authorization_endpoint, jwks_uri, and token_endpoint.");
+  }
+  discoveryCache.set(key, { discovery, fetchedAt: Date.now() });
+  return discovery;
+}
+async function loadOidcJwks(jwksUri, options = {}) {
+  const cached = jwksCache.get(jwksUri);
+  if (!options.force && cached && Date.now() - cached.fetchedAt < JWKS_TTL_MS) {
+    return cached.keys;
+  }
+  const body = await fetchJson(jwksUri);
+  const keys = Array.isArray(body.keys) ? body.keys : [];
+  if (keys.length === 0) {
+    throw new Error("OIDC JWKS document did not include signing keys.");
+  }
+  jwksCache.set(jwksUri, { keys, fetchedAt: Date.now() });
+  return keys;
+}
+function decodeJwtPart(value) {
+  try {
+    return JSON.parse(Buffer.from(value, "base64url").toString("utf8"));
+  } catch {
+    return null;
+  }
+}
+function publicKeyFromJwk(jwk) {
+  if (jwk.kty !== "RSA" || !jwk.n || !jwk.e) {
+    return null;
+  }
+  return createPublicKey({
+    format: "jwk",
+    key: {
+      kty: "RSA",
+      n: jwk.n,
+      e: jwk.e
+    }
+  });
+}
+function verifyRs256Signature(signingInput, signature, key) {
+  const verifier = createVerify("RSA-SHA256");
+  verifier.update(signingInput);
+  verifier.end();
+  return verifier.verify(key, Buffer.from(signature, "base64url"));
+}
+function oidcAccessTokenHash(accessToken) {
+  const digest = createHash("sha256").update(accessToken).digest();
+  return digest.subarray(0, digest.length / 2).toString("base64url");
+}
+function assertIdTokenClaims(payload, options) {
+  if (payload.iss !== issuerOrigin(options.issuer)) {
+    throw new Error("OIDC ID token issuer mismatch.");
+  }
+  const audience = payload.aud;
+  const audiences = (Array.isArray(audience) ? audience : [audience]).filter((value) => typeof value === "string" && value.length > 0);
+  if (!audiences.includes(options.clientId)) {
+    throw new Error("OIDC ID token audience mismatch.");
+  }
+  if (audiences.length > 1 && payload.azp !== options.clientId) {
+    throw new Error("OIDC ID token authorized party mismatch.");
+  }
+  if (payload.azp !== undefined && payload.azp !== options.clientId) {
+    throw new Error("OIDC ID token authorized party mismatch.");
+  }
+  if (typeof payload.at_hash === "string" && !options.accessToken) {
+    throw new Error("OIDC ID token access token hash mismatch.");
+  }
+  if (options.accessToken) {
+    const expected = oidcAccessTokenHash(options.accessToken);
+    if (typeof payload.at_hash !== "string" || !timingSafeCompareString(payload.at_hash, expected)) {
+      throw new Error("OIDC ID token access token hash mismatch.");
+    }
+  }
+  if (typeof payload.nonce !== "string" || payload.nonce.length === 0) {
+    throw new Error("OIDC ID token nonce mismatch.");
+  }
+  if (payload.nonce !== options.nonce) {
+    throw new Error("OIDC ID token nonce mismatch.");
+  }
+  if (typeof payload.exp !== "number" || !Number.isFinite(payload.exp) || payload.exp * 1000 <= Date.now()) {
+    throw new Error("OIDC ID token is expired.");
+  }
+  if (typeof payload.nbf === "number" && payload.nbf * 1000 > Date.now()) {
+    throw new Error("OIDC ID token is not yet valid.");
+  }
+}
+async function verifyOidcIdToken(token, options) {
+  const parts = token.split(".");
+  if (parts.length !== 3 || !parts[0] || !parts[1] || !parts[2]) {
+    throw new Error("OIDC ID token signature is invalid.");
+  }
+  const header = decodeJwtPart(parts[0]);
+  if (header?.alg !== "RS256") {
+    throw new Error("OIDC ID token algorithm must be RS256.");
+  }
+  let keys = await loadOidcJwks(options.jwksUri);
+  let candidates = header.kid ? keys.filter((key) => key.kid === header.kid) : keys;
+  if (header.kid && candidates.length === 0) {
+    keys = await loadOidcJwks(options.jwksUri, { force: true });
+    candidates = keys.filter((key) => key.kid === header.kid);
+  }
+  const signingInput = `${parts[0]}.${parts[1]}`;
+  let verified = false;
+  for (const jwk of candidates) {
+    const key = publicKeyFromJwk(jwk);
+    if (key && verifyRs256Signature(signingInput, parts[2], key)) {
+      verified = true;
+      break;
+    }
+  }
+  if (!verified) {
+    throw new Error("OIDC ID token signature is invalid.");
+  }
+  const payload = decodeJwtPart(parts[1]);
+  if (!payload || payload.sub === undefined || payload.sub === null) {
+    throw new Error("OIDC ID token signature is invalid.");
+  }
+  assertIdTokenClaims(payload, options);
+  return payload;
+}
+function resetOidcDiscoveryCacheForTests() {
+  discoveryCache.clear();
+  jwksCache.clear();
+}
+
+// ../../src/core/auth/oauth/oidcProvider.ts
+function base64Url(bytes) {
+  return Buffer.from(bytes).toString("base64url");
+}
+function createOidcHandshake() {
+  return {
+    state: randomBytes(24).toString("hex"),
+    nonce: randomBytes(24).toString("hex"),
+    codeVerifier: base64Url(randomBytes(32))
+  };
+}
+function codeChallenge(verifier) {
+  return createHash2("sha256").update(verifier).digest("base64url");
+}
+function requireOidcEndpoint(value, name) {
+  const trimmed = value?.trim() ?? "";
+  if (!trimmed) {
+    throw new Error(`OIDC discovery document did not include ${name}.`);
+  }
+  return trimmed;
+}
+
 class OidcProvider {
   options;
   name;
@@ -7,43 +495,77 @@ class OidcProvider {
     this.options = options;
     this.name = options.name;
   }
-  getAuthorizationUrl(state, redirectUri = this.options.redirectUri) {
+  getAuthorizationUrl(_state, _redirectUri = this.options.redirectUri) {
+    throw new Error("OidcProvider.getAuthorizationUrl cannot complete PKCE. Use createAuthorization() and pass the handshake to exchangeCode().");
+  }
+  async createAuthorization(state = createOidcHandshake().state, redirectUri = this.options.redirectUri) {
+    const discovery = await loadOidcDiscovery(this.options.issuer);
+    const handshake = { ...createOidcHandshake(), state };
+    return {
+      url: this.buildAuthorizationUrl(state, handshake, redirectUri, requireOidcEndpoint(discovery.authorization_endpoint, "authorization_endpoint")),
+      handshake
+    };
+  }
+  buildAuthorizationUrl(state, handshake, redirectUri, authorizationEndpoint) {
     const params = new URLSearchParams({
       client_id: this.options.clientId,
       redirect_uri: redirectUri,
       response_type: "code",
       scope: (this.options.scopes ?? ["openid", "email", "profile"]).join(" "),
-      state
+      state,
+      nonce: handshake.nonce,
+      code_challenge: codeChallenge(handshake.codeVerifier),
+      code_challenge_method: "S256"
     });
-    return `${this.options.issuer.replace(/\/$/, "")}/authorize?${params.toString()}`;
+    return `${authorizationEndpoint}?${params.toString()}`;
   }
-  async exchangeCode(code, redirectUri = this.options.redirectUri) {
-    const tokenResponse = await fetch(`${this.options.issuer.replace(/\/$/, "")}/token`, {
+  async exchangeCode(code, redirectUri = this.options.redirectUri, handshake) {
+    if (!handshake?.nonce?.trim() || !handshake.codeVerifier?.trim()) {
+      throw new Error("OIDC token exchange requires the PKCE handshake from createAuthorization().");
+    }
+    const discovery = await loadOidcDiscovery(this.options.issuer);
+    const body = new URLSearchParams({
+      grant_type: "authorization_code",
+      code,
+      redirect_uri: redirectUri,
+      client_id: this.options.clientId,
+      client_secret: this.options.clientSecret,
+      code_verifier: handshake.codeVerifier
+    });
+    const tokenResponse = await safeFetch(requireOidcEndpoint(discovery.token_endpoint, "token_endpoint"), {
       method: "POST",
       headers: { "content-type": "application/x-www-form-urlencoded" },
-      body: new URLSearchParams({
-        grant_type: "authorization_code",
-        code,
-        redirect_uri: redirectUri,
-        client_id: this.options.clientId,
-        client_secret: this.options.clientSecret
-      })
-    });
+      body
+    }, { allowHttp: !isProductionEnv(), timeoutMs: 1e4, maxRedirects: 0 });
     const tokenBody = await tokenResponse.json();
     if (!tokenBody.access_token) {
       throw new Error("OIDC token exchange failed.");
     }
-    const profileResponse = await fetch(`${this.options.issuer.replace(/\/$/, "")}/userinfo`, {
-      headers: { authorization: `Bearer ${tokenBody.access_token}` }
+    if (!tokenBody.id_token) {
+      throw new Error("OIDC token exchange did not return an ID token.");
+    }
+    const payload = await verifyOidcIdToken(tokenBody.id_token, {
+      issuer: this.options.issuer,
+      clientId: this.options.clientId,
+      nonce: handshake.nonce,
+      jwksUri: requireOidcEndpoint(discovery.jwks_uri, "jwks_uri"),
+      accessToken: tokenBody.access_token
     });
-    const profile = await profileResponse.json();
+    if (typeof payload.email !== "string" || !payload.email.trim()) {
+      throw new Error("OIDC ID token did not include an email address.");
+    }
+    if (payload.email_verified !== true) {
+      throw new Error("OIDC ID token email is not verified.");
+    }
     return {
-      providerUserId: profile.sub,
-      email: profile.email ?? `${profile.sub}@oidc.local`,
-      name: profile.name ?? profile.sub
+      providerUserId: String(payload.sub),
+      email: payload.email,
+      name: typeof payload.name === "string" && payload.name ? payload.name : String(payload.sub)
     };
   }
 }
 export {
-  OidcProvider
+  OidcProvider,
+  createOidcHandshake,
+  resetOidcDiscoveryCacheForTests
 };