@growth-labs/auth 0.10.4 → 0.12.0

package/src/routes/api/shared.ts

@@ -4,6 +4,7 @@ import { type AuthClientCodeResult, type AuthClientOkResult, authClient } from '
 import {
 	type AuthAnalyticsProvider,
 	analyticsAvailable,
+	emitAuthEvent,
 	emitAuthFailureEvent,
 	emitAuthSuccessEvent,
 } from '../../utils/analytics.js'
@@ -240,6 +241,26 @@ function queueAuthFailure(
 	)
 }
 
+/**
+ * Fire-and-forget step event for the auth funnel's intermediate stages
+ * (code requested, reset requested). Success/failure terminals already
+ * emit via emitAuthSuccessEvent / queueAuthFailure; without the steps
+ * between them, a request→verify drop-off is invisible in analytics.
+ */
+export function queueAuthStep(
+	context: RouteContext,
+	eventName: string,
+	data: Record<string, unknown>,
+): void {
+	if (!analyticsAvailable(context)) return
+	resolveWaitUntil(context)(
+		emitAuthEvent(context, eventName, {
+			...data,
+			authPath: context.url.pathname,
+		}),
+	)
+}
+
 async function setOptionalIdentityCookie(response: Response, subject: string): Promise<void> {
 	const secret = getRuntimeEnv().GL_IDENTITY_SECRET
 	if (typeof secret !== 'string' || !secret) return

package/src/utils/client-secret-header.ts

@@ -0,0 +1,8 @@
+export function createClientSecretBasicAuthHeader(clientId: string, clientSecret: string): string {
+	return `Basic ${btoa(`${formEncode(clientId)}:${formEncode(clientSecret)}`)}`
+}
+
+function formEncode(value: string): string {
+	const params = new URLSearchParams({ value })
+	return params.toString().slice('value='.length)
+}

package/src/utils/client-secret.ts

@@ -5,6 +5,7 @@ import {
 	literalClientSecret,
 } from './client-secret-literal.js'
 
+export { createClientSecretBasicAuthHeader } from './client-secret-header.js'
 export type { ClientSecretLiteral }
 export { isClientSecretLiteral, literalClientSecret }
 
@@ -140,12 +141,3 @@ export async function resolveClientSecret(
 	// No Request context: resolve without caching (test or internal call).
 	return doResolve(clientSecret)
 }
-
-export function createClientSecretBasicAuthHeader(clientId: string, clientSecret: string): string {
-	return `Basic ${btoa(`${formEncode(clientId)}:${formEncode(clientSecret)}`)}`
-}
-
-function formEncode(value: string): string {
-	const params = new URLSearchParams({ value })
-	return params.toString().slice('value='.length)
-}

package/src/utils/cookies.ts

@@ -16,7 +16,12 @@ export function getCookie(request: Request, name: string): string | null {
 	const header = request.headers.get('cookie')
 	if (!header) return null
 	const match = header.match(new RegExp(`(?:^|;\\s*)${name}=([^;]*)`))
-	return match ? decodeURIComponent(match[1]) : null
+	if (!match) return null
+	try {
+		return decodeURIComponent(match[1])
+	} catch {
+		return null
+	}
 }
 
 export function setCookie(

package/src/utils/tokens.ts

@@ -1,7 +1,8 @@
 import { createLocalJWKSet, jwtVerify } from 'jose'
 import { JWTExpired } from 'jose/errors'
 import type { TokenRefreshResult } from '../types.js'
-import { createClientSecretBasicAuthHeader } from './client-secret.js'
+import { createClientSecretBasicAuthHeader } from './client-secret-header.js'
+import { extractIdentityId } from './identity.js'
 
 type JWKSFunction = ReturnType<typeof createLocalJWKSet>
 
@@ -69,6 +70,9 @@ export interface VerifiedClaims {
 	image?: string
 	synthetic?: boolean
 	purpose?: string
+	userId?: string
+	roles?: string[]
+	audiences?: string[]
 }
 
 export interface TokenPayloadClaims extends VerifiedClaims {
@@ -103,6 +107,12 @@ export interface VerifyAccessTokenOptions {
 	audience?: string | string[]
 	/** Signature algorithms to accept. Defaults to `['ES256']` (identity-platform's signing alg). */
 	algorithms?: string[]
+	/** Fetch signing keys from this backchannel base while still enforcing `issuer`. */
+	jwksIssuer?: string
+	/** Enforce the identity-platform user access-token claim contract. */
+	requireUserToken?: boolean
+	/** Permitted JWT clock skew in seconds for strict user-token validation. */
+	clockSkew?: number
 }
 
 async function verifyAccessTokenPayload(
@@ -113,15 +123,38 @@ async function verifyAccessTokenPayload(
 	try {
 		const header = decodeJwtHeader(token)
 		const kid = typeof header.kid === 'string' ? header.kid : undefined
-		const jwks = await getJWKS(issuer, kid)
+		const jwks = await getJWKS(options.jwksIssuer ?? issuer, kid)
 		const { payload } = await jwtVerify(token, jwks, {
 			issuer,
 			audience: options.audience,
 			algorithms: options.algorithms ?? ['ES256'],
+			clockTolerance: options.clockSkew,
 		})
 		if (payload.mode !== 'access') {
 			throw new Error(`unexpected token mode: ${String(payload.mode)}`)
 		}
+		if (options.requireUserToken) {
+			const properties = payload.properties
+			if (
+				payload.type !== 'user' ||
+				typeof payload.iat !== 'number' ||
+				typeof payload.exp !== 'number' ||
+				typeof payload.sub !== 'string' ||
+				typeof properties !== 'object' ||
+				properties === null
+			) {
+				throw new Error('required user access-token claims are missing')
+			}
+			const userId = extractIdentityId(payload.sub)
+			if (
+				payload.iat > Math.floor(Date.now() / 1000) + (options.clockSkew ?? 0) ||
+				(properties as Record<string, unknown>).userId !== userId ||
+				typeof (properties as Record<string, unknown>).email !== 'string' ||
+				(properties as Record<string, unknown>).email === ''
+			) {
+				throw new Error('access-token identity claims are inconsistent')
+			}
+		}
 		return payload as Record<string, unknown>
 	} catch (err) {
 		if (!isExpiredJwtError(err)) {
@@ -139,6 +172,12 @@ export async function verifyAccessToken(
 	const payload = await verifyAccessTokenPayload(issuer, token, options)
 	if (!payload) return null
 	const claims = extractTokenClaims(payload)
+	const properties = (payload.properties ?? {}) as Record<string, unknown>
+	const audience = Array.isArray(payload.aud)
+		? payload.aud.filter((value): value is string => typeof value === 'string')
+		: typeof payload.aud === 'string'
+			? [payload.aud]
+			: []
 	return {
 		sub: claims.sub,
 		email: claims.email,
@@ -146,6 +185,11 @@ export async function verifyAccessToken(
 		image: claims.image,
 		synthetic: payload.synthetic === true ? true : undefined,
 		purpose: typeof payload.purpose === 'string' ? payload.purpose : undefined,
+		userId: typeof properties.userId === 'string' ? properties.userId : undefined,
+		roles: Array.isArray(payload.roles)
+			? payload.roles.filter((value): value is string => typeof value === 'string')
+			: undefined,
+		audiences: audience,
 	}
 }