@grest-ts/oauth 0.0.0-stage → 0.0.89

package/src/node/store/InMemoryOAuthStore.ts

@@ -0,0 +1,54 @@
+import {errors as oidcErrors} from "oidc-provider"
+import type {GGOAuthPayload, GGOAuthStore} from "./GGOAuthStore"
+
+type Row = {model: string, id: string, payload: GGOAuthPayload, expiresAt: number | undefined}
+
+// Single-process only (tests, local dev): state is lost on restart and not shared across instances.
+export class InMemoryOAuthStore implements GGOAuthStore {
+
+    private readonly rows = new Map<string, Row>()
+
+    private readonly now: () => number
+
+    constructor(now: () => number = Date.now) {
+        this.now = now
+    }
+
+    public upsert = async (model: string, id: string, payload: GGOAuthPayload, expiresInSec: number | undefined): Promise<void> => {
+        this.rows.set(`${model}:${id}`, {model, id, payload, expiresAt: expiresInSec ? this.now() + expiresInSec * 1000 : undefined})
+    }
+
+    public find = async (model: string, id: string): Promise<GGOAuthPayload | undefined> => this.live(this.rows.get(`${model}:${id}`))?.payload
+
+    public findByUid = async (model: string, uid: string) => this.findWhere(model, p => p.uid === uid)
+
+    public consume = async (model: string, id: string): Promise<void> => {
+        const row = this.rows.get(`${model}:${id}`)
+        if (!row) {
+            if (model === "AuthorizationCode" || model === "RefreshToken") throw new oidcErrors.InvalidGrant(`${model} revoked`)
+            return
+        }
+        if (row.payload.consumed !== undefined) throw new oidcErrors.InvalidGrant(`${model} already used`)
+        row.payload = {...row.payload, consumed: Math.floor(this.now() / 1000)}
+    }
+
+    public destroy = async (model: string, id: string): Promise<void> => {
+        this.rows.delete(`${model}:${id}`)
+    }
+
+    public revokeByGrantId = async (grantId: string): Promise<void> => {
+        for (const [key, row] of this.rows) if (row.payload.grantId === grantId) this.rows.delete(key)
+    }
+
+    public listIdsByAccount = async (model: string, accountId: string): Promise<string[]> =>
+        [...this.rows.values()].filter(r => r.model === model && this.live(r) && r.payload.accountId === accountId).map(r => r.id)
+
+    private findWhere(model: string, match: (p: GGOAuthPayload) => boolean): GGOAuthPayload | undefined {
+        for (const row of this.rows.values()) if (row.model === model && this.live(row) && match(row.payload)) return row.payload
+        return undefined
+    }
+
+    private live(row: Row | undefined): Row | undefined {
+        return row && (row.expiresAt === undefined || row.expiresAt > this.now()) ? row : undefined
+    }
+}

package/src/shared/interactionContract.ts

@@ -0,0 +1,39 @@
+import {FORBIDDEN, GG_NO_PERMISSIONS, GGContractClass, IsArray, IsBoolean, IsObject, IsString, NOT_AUTHORIZED, NOT_FOUND, SERVER_ERROR} from "@grest-ts/schema"
+
+export const IsGGOAuthInteractionClient = IsObject({
+    clientId: IsString,
+    name: IsString,
+    /** Pre-registered by the app (its own UI/CLI). Third-party clients must be shown a consent screen. */
+    firstParty: IsBoolean,
+    /** Hosts the authorization code is sent to — show these on the consent screen. */
+    redirectHosts: IsArray(IsString),
+    /** Every redirect is a loopback address: any local process could be posing as this client. */
+    loopbackOnly: IsBoolean,
+})
+export type GGOAuthInteractionClient = typeof IsGGOAuthInteractionClient.infer
+
+export const IsGGOAuthInteraction = IsObject({
+    uid: IsString,
+    client: IsGGOAuthInteractionClient,
+    scopes: IsArray(IsString),
+    /** The resource (API) the client asks for access to. */
+    resource: IsString,
+})
+export type GGOAuthInteraction = typeof IsGGOAuthInteraction.infer
+
+const IsUid = IsObject({uid: IsString.nonEmpty})
+/** Where the browser must navigate next: back to the authorization server, which finishes the flow. */
+const IsRedirect = IsObject({redirectUrl: IsString})
+
+/**
+ * The app's login/consent page talks to this. Bind it with the app's own user wire — the
+ * signed-in user becomes the OAuth subject — e.g.
+ *   new GGHttpSchema({contract: GGOAuthInteractionContract, pathPrefix: "api/oauth/interaction", use: [USER_WIRE], routes: {...}})
+ */
+export const GGOAuthInteractionContract = new GGContractClass("GGOAuthInteraction", {
+    get: {input: IsUid, success: IsGGOAuthInteraction, errors: [NOT_FOUND, NOT_AUTHORIZED, SERVER_ERROR], permission: GG_NO_PERMISSIONS},
+    /** The signed-in user approves: the browser then follows redirectUrl to receive the code. */
+    approve: {input: IsUid, success: IsRedirect, errors: [NOT_FOUND, NOT_AUTHORIZED, FORBIDDEN, SERVER_ERROR], permission: GG_NO_PERMISSIONS},
+    /** The user declines: the client receives access_denied. */
+    deny: {input: IsUid, success: IsRedirect, errors: [NOT_FOUND, NOT_AUTHORIZED, SERVER_ERROR], permission: GG_NO_PERMISSIONS},
+})

package/src/tsconfig.json

@@ -0,0 +1,18 @@
+{
+  "//": "THIS FILE IS GENERATED - DO NOT EDIT",
+  "extends": "../../../../tsconfig.base.json",
+  "compilerOptions": {
+    "rootDir": ".",
+    "lib": [
+      "ES2022",
+      "DOM"
+    ],
+    "types": [
+      "node",
+      "vitest/globals"
+    ]
+  },
+  "include": [
+    "**/*"
+  ]
+}