@growth-labs/auth 0.17.0 → 0.18.3

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@growth-labs/auth",
-  "version": "0.17.0",
+  "version": "0.18.3",
   "type": "module",
   "types": "./dist/index.d.ts",
   "exports": {

package/src/middleware/auth.ts

@@ -1,4 +1,5 @@
 import { getConfig } from '../config-store.js'
+import { resolveIssuerFetch } from '../utils/issuer-fetch.js'
 import '../runtime-bridge.js'
 import type { AuthSessionState, User } from '../types.js'
 import { resolveClientSecret } from '../utils/client-secret.js'
@@ -32,6 +33,7 @@ export async function onRequest(
 	next: () => Promise<Response>,
 ): Promise<Response> {
 	const options = getConfig()
+	const nonConsumablePath = isGatedPath(context.url.pathname, options.nonConsumablePaths ?? [])
 	const issuer = resolveInternalIssuer(options)
 	const { request } = context
 
@@ -52,7 +54,8 @@ export async function onRequest(
 	// below. A refresh token explicitly opts the request into this fail-closed
 	// confidential-session invariant even when its access token would verify;
 	// an access-token-only request never needs or reads the client secret.
-	if (refreshToken && options.clientSecret !== undefined) {
+	// Configured non-consumable paths cannot refresh, so they do not need it either.
+	if (refreshToken && options.clientSecret !== undefined && !nonConsumablePath) {
 		const secretResult = await resolveClientSecret(options.clientSecret, request)
 		if (!secretResult.ok) {
 			context.locals.user = null
@@ -65,7 +68,16 @@ export async function onRequest(
 	}
 
 	if (accessToken) {
-		const verified = await verifyAccessToken(issuer, accessToken, { audience: options.resource })
+		const verified = await verifyAccessToken(
+			options.issuerFetch ? options.issuer : issuer,
+			accessToken,
+			{
+				audience: options.resource,
+				...(options.issuerFetch
+					? { jwksIssuer: issuer, jwksFetch: resolveIssuerFetch(options) }
+					: {}),
+			},
+		)
 		if (verified) {
 			user = {
 				id: verified.sub,
@@ -84,10 +96,11 @@ export async function onRequest(
 	// does not get it: the request is answered as `deferred` and the next
 	// consumable request refreshes instead (refresh-carrier.ts says why).
 	let refreshFailure = null as RefreshFailure | null
-	let deferredCarrier: RefreshCarrier | null = null
+	let deferredCarrier: RefreshCarrier | 'path' | null = null
 	if (!user && refreshToken) {
 		const carrier = classifyRefreshCarrier(request)
 		if (carrier !== 'consumable') deferredCarrier = carrier
+		else if (nonConsumablePath) deferredCarrier = 'path'
 	}
 
 	// Confirm before clear (refresh-rejection.ts). A refresh token the issuer
@@ -129,6 +142,9 @@ export async function onRequest(
 				(failure) => {
 					refreshFailure = failure
 				},
+				...(options.issuerFetch
+					? [{ issuerFetch: resolveIssuerFetch(options), verificationIssuer: options.issuer }]
+					: []),
 			)
 			if (refreshed) {
 				user = {

package/src/options.ts

@@ -26,6 +26,14 @@ export const authOptionsSchema = z.object({
 	// ─── Issuer URLs ───
 	issuer: urlOrEnvMarker,
 	issuerInternal: urlOrEnvMarker.optional(),
+	// Cloudflare service binding used for every issuer backchannel call.
+	issuerFetch: z.string().trim().min(1).optional(),
+	rateLimits: z
+		.object({
+			codeRequest: z.object({ ip: z.string().min(1), email: z.string().min(1) }),
+			codeVerify: z.object({ ip: z.string().min(1), email: z.string().min(1) }),
+		})
+		.optional(),
 
 	// ─── Client identity ───
 	clientId: stringOrEnvMarker.optional(),
@@ -55,6 +63,8 @@ export const authOptionsSchema = z.object({
 
 	// ─── Path configuration ───
 	gatedPaths: z.array(z.string()).default([]),
+	// Verify identity normally, but never rotate refresh tokens on these requests.
+	nonConsumablePaths: z.array(z.string()).optional(),
 	loginPath: z.string().default('/login'),
 	logoutRedirect: z.string().default('/'),
 	callbackPath: z.string().default('/api/auth/callback'),

package/src/routes/api/code-request.ts

@@ -1,3 +1,7 @@
+import { getCookie } from '../../utils/cookies.js'
+import { sameOriginRedirect } from '../../utils/issuer.js'
+import { withAuthFlowCookies } from '../flow.js'
+import { enforceCodeRateLimit } from './rate-limit.js'
 import {
 	authClient,
 	failClosedOnSecretResolutionFailure,
@@ -25,7 +29,12 @@ export async function POST(context: RouteContext): Promise<Response> {
 
 	const form = await readForm(context)
 	const email = await readFormString(form, 'email')
-	const redirect = form.get('redirect')?.toString()
+	const redirect =
+		form.get('redirect')?.toString() ??
+		getCookie(context.request, `${options.cookiePrefix}_redirect`) ??
+		undefined
+	const limited = await enforceCodeRateLimit(context, 'codeRequest', email)
+	if (limited) return limited
 	const surface =
 		form.get('auth_surface')?.toString() === 'create-account' ? 'create-account' : 'login'
 	const surfacePath = surface === 'create-account' ? '/create-account/' : options.verifyCodePath
@@ -39,7 +48,7 @@ export async function POST(context: RouteContext): Promise<Response> {
 		})
 	}
 
-	return statusRedirect(
+	const response = statusRedirect(
 		context,
 		result,
 		surfacePath,
@@ -48,4 +57,13 @@ export async function POST(context: RouteContext): Promise<Response> {
 		{ email, redirect },
 		'email-code',
 	)
+	if ('error' in result) return response
+	return withAuthFlowCookies(
+		context,
+		options,
+		response,
+		sameOriginRedirect(redirect, context.url.origin),
+		'email-code',
+		900,
+	)
 }

package/src/routes/api/code-verify.ts

@@ -1,3 +1,5 @@
+import { clearAuthFlowCookies, getCookie } from '../../utils/cookies.js'
+import { enforceCodeRateLimit } from './rate-limit.js'
 import {
 	authClient,
 	callbackRedirect,
@@ -25,20 +27,35 @@ export async function POST(context: RouteContext): Promise<Response> {
 	const form = await readForm(context)
 	const email = await readFormString(form, 'email')
 	const code = await readFormString(form, 'code')
+	const limited = await enforceCodeRateLimit(context, 'codeVerify', email)
+	if (limited) {
+		clearAuthFlowCookies(limited, options)
+		return limited
+	}
 	const errorPath =
 		form.get('auth_surface')?.toString() === 'create-account'
 			? '/create-account/'
 			: options.verifyCodePath
 	const result = await authClient(context).code.verify({ email, code })
 
-	return callbackRedirect(
+	const response = await callbackRedirect(
 		context,
 		result,
 		errorPath,
 		{
 			email,
-			redirect: form.get('redirect')?.toString(),
+			redirect:
+				form.get('redirect')?.toString() ??
+				getCookie(context.request, `${options.cookiePrefix}_redirect`) ??
+				undefined,
 		},
 		'email-code',
 	)
+	if (!('error' in result)) return response
+	const mutable = new Response(response.body, {
+		status: response.status,
+		headers: new Headers(response.headers),
+	})
+	clearAuthFlowCookies(mutable, options)
+	return mutable
 }

package/src/routes/api/rate-limit.ts

@@ -0,0 +1,48 @@
+import { getConfig } from '../../config-store.js'
+import { getRuntimeEnv } from '../../runtime.js'
+import type { RouteContext } from '../flow.js'
+
+interface Limiter {
+	limit(input: { key: string }): Promise<{ success: boolean }>
+}
+
+/** Both dimensions use native rate limits; email keys contain only a SHA-256 digest. */
+export async function enforceCodeRateLimit(
+	context: RouteContext,
+	operation: 'codeRequest' | 'codeVerify',
+	email: string,
+): Promise<Response | null> {
+	const bindings = getConfig().rateLimits?.[operation]
+	if (!bindings) return null
+	const env = getRuntimeEnv()
+	try {
+		const digest = await crypto.subtle.digest(
+			'SHA-256',
+			new TextEncoder().encode(email.trim().toLowerCase()),
+		)
+		const emailKey = Array.from(new Uint8Array(digest), (byte) =>
+			byte.toString(16).padStart(2, '0'),
+		).join('')
+		for (const [dimension, key] of [
+			['ip', context.request.headers.get('cf-connecting-ip') || 'unknown'],
+			['email', emailKey],
+		] as const) {
+			const binding = env[bindings[dimension]] as Limiter | undefined
+			if (!binding || typeof binding.limit !== 'function')
+				throw new Error('missing rate limit binding')
+			const result = await binding.limit({ key: `${operation}:${dimension}:${key}` })
+			if (!result.success)
+				return Response.json(
+					{ error: 'rate_limited' },
+					{ status: 429, headers: { 'Cache-Control': 'private, no-store', 'Retry-After': '60' } },
+				)
+		}
+		return null
+	} catch {
+		console.error('@growth-labs/auth: configured code rate limiter unavailable')
+		return Response.json(
+			{ error: 'auth_service_unavailable' },
+			{ status: 503, headers: { 'Cache-Control': 'private, no-store' } },
+		)
+	}
+}

package/src/routes/api/shared.ts

@@ -19,6 +19,7 @@ import {
 import { secretResolutionFailureResponse } from '../../utils/fail-closed.js'
 import { canonicalIdentitySubject } from '../../utils/identity.js'
 import { createIdentityCookiePayload, signIdentityCookie } from '../../utils/identity-cookie.js'
+import { sameOriginRedirect } from '../../utils/issuer.js'
 import { exchangeCode } from '../../utils/openauth.js'
 import { resolveWaitUntil } from '../../utils/wait-until.js'
 import { type RouteContext, readForm, redirectLocation, redirectTo } from '../flow.js'
@@ -132,7 +133,7 @@ function routeResult(
 	}
 
 	return Response.json(error ? { error, redirect: location } : { ok: true, redirect: location }, {
-		status: error ? 400 : 200,
+		status: error === 'rate_limited' || error === 'too_many_attempts' ? 429 : error ? 400 : 200,
 	})
 }
 
@@ -202,7 +203,7 @@ async function completeJsonAuth(
 	const tokenResponse = exchangeResult
 
 	const redirectPath = getCookie(context.request, `${options.cookiePrefix}_redirect`) || '/'
-	const redirect = new URL(redirectPath, context.url.origin).toString()
+	const redirect = sameOriginRedirect(redirectPath, context.url.origin)
 	const response = mutableHeaders(Response.json({ ok: true, redirect }))
 
 	setTokenCookies(response, options, tokenResponse.accessToken, tokenResponse.refreshToken)

package/src/routes/callback.ts

@@ -14,6 +14,7 @@ import {
 import { secretResolutionFailureResponse } from '../utils/fail-closed.js'
 import { canonicalIdentitySubject } from '../utils/identity.js'
 import { createIdentityCookiePayload, signIdentityCookie } from '../utils/identity-cookie.js'
+import { sameOriginRedirect } from '../utils/issuer.js'
 import { exchangeCode } from '../utils/openauth.js'
 import { verifyState } from '../utils/state.js'
 import { resolveWaitUntil } from '../utils/wait-until.js'
@@ -131,7 +132,7 @@ export async function GET(context: CallbackContext): Promise<Response> {
 
 	// Build redirect response
 	const redirectPath = getCookie(request, `${options.cookiePrefix}_redirect`) || '/'
-	const redirect = new URL(redirectPath, url.origin).toString()
+	const redirect = sameOriginRedirect(redirectPath, url.origin)
 	const response = wantsJson(request)
 		? Response.json({ ok: true, redirect })
 		: Response.redirect(redirect, 302)

package/src/routes/flow.ts

@@ -19,6 +19,7 @@ export async function withAuthFlowCookies(
 	response: Response,
 	redirectPath: string,
 	provider?: string,
+	maxAge?: number,
 ): Promise<Response> {
 	const authFlow = await createAuthFlow(context)
 	const mutable = new Response(response.body, {
@@ -29,6 +30,7 @@ export async function withAuthFlowCookies(
 	setAuthFlowCookies(mutable, options, authFlow.verifier, authFlow.state, redirectPath, provider, {
 		pkcePath: '/',
 		additionalPkcePaths: [options.callbackPath],
+		maxAge,
 	})
 	return mutable
 }

package/src/routes/login.ts

@@ -2,6 +2,7 @@ import { loginPageScript } from '../client/login-page.js'
 import { getConfig } from '../config-store.js'
 import { getRenderer, loginRendererPayload, renderHtmlResponse } from '../renderers.js'
 import { setAuthFlowCookies } from '../utils/cookies.js'
+import { sameOriginRedirect } from '../utils/issuer.js'
 import { createAuthFlow, getAuthorizationUrl } from '../utils/openauth.js'
 
 interface LoginContext {
@@ -24,6 +25,11 @@ export async function GET(context: LoginContext): Promise<Response> {
 		selectedProvider &&
 		options.providers.includes(selectedProvider as (typeof options.providers)[number])
 	) {
+		if (selectedProvider === 'email-code' && getRenderer('verifyCode')) {
+			const local = new URL(options.verifyCodePath, context.url.origin)
+			local.searchParams.set('redirect', sameOriginRedirect(redirectPath, context.url.origin))
+			return Response.redirect(local, 302)
+		}
 		const authFlow = await createAuthFlow(context)
 		const issuerProvider = selectedProvider === 'email-code' ? 'code' : selectedProvider
 		const { url } = await getAuthorizationUrl(context, issuerProvider, redirectPath, authFlow)

package/src/routes/verify-code.ts

@@ -1,5 +1,7 @@
 import { getConfig } from '../config-store.js'
 import { getRenderer, renderHtmlResponse, verifyCodeRendererPayload } from '../renderers.js'
+import { getCookie } from '../utils/cookies.js'
+import { sameOriginRedirect } from '../utils/issuer.js'
 import { type RouteContext, withAuthFlowCookies } from './flow.js'
 
 export async function GET(context: RouteContext): Promise<Response> {
@@ -13,7 +15,11 @@ export async function GET(context: RouteContext): Promise<Response> {
 		return new Response('Not found', { status: 404 })
 	}
 
-	const redirectPath = context.url.searchParams.get('redirect') || '/'
+	const redirectPath = sameOriginRedirect(
+		context.url.searchParams.get('redirect') ??
+			getCookie(context.request, `${options.cookiePrefix}_redirect`),
+		context.url.origin,
+	)
 	const authSurface =
 		context.url.pathname === '/create-account/' ||
 		context.url.searchParams.get('auth_surface') === 'create-account'
@@ -30,5 +36,5 @@ export async function GET(context: RouteContext): Promise<Response> {
 			}),
 		),
 	)
-	return withAuthFlowCookies(context, options, response, redirectPath, 'email-code')
+	return withAuthFlowCookies(context, options, response, redirectPath, 'email-code', 900)
 }

package/src/server.ts

@@ -7,6 +7,7 @@ import {
 	reportClientSecretResolutionFailure,
 } from './utils/fail-closed.js'
 import { resolveInternalIssuer } from './utils/issuer.js'
+import { resolveIssuerFetch } from './utils/issuer-fetch.js'
 import { createPKCEChallenge } from './utils/pkce.js'
 
 export { ClientSecretResolutionError }
@@ -75,6 +76,8 @@ async function headersFor(
 	context: AuthClientContext,
 ): Promise<Record<string, string>> {
 	const headers: Record<string, string> = { 'Content-Type': 'application/json' }
+	const clientIp = context.request.headers.get('cf-connecting-ip')
+	if (clientIp) headers['X-Auth-Client-IP'] = clientIp
 	const secretResult = await resolveClientSecret(options.clientSecret, context.request)
 	if (!secretResult.ok) throw new ClientSecretResolutionError(secretResult.code)
 	if (secretResult.secret) {
@@ -106,11 +109,14 @@ async function postJson<T extends AuthClientCodeResult | AuthClientOkResult>(
 	body: Record<string, unknown>,
 ): Promise<T> {
 	try {
-		const response = await fetch(`${resolveInternalIssuer(options)}${pathname}`, {
-			method: 'POST',
-			headers: await headersFor(options, context),
-			body: JSON.stringify(body),
-		})
+		const response = await resolveIssuerFetch(options)(
+			`${resolveInternalIssuer(options)}${pathname}`,
+			{
+				method: 'POST',
+				headers: await headersFor(options, context),
+				body: JSON.stringify(body),
+			},
+		)
 		const json = await readJson(response)
 
 		if (typeof json.error === 'string') {

package/src/utils/cookies.ts

@@ -112,14 +112,14 @@ export function setAuthFlowCookies(
 	state: string,
 	redirectPath: string,
 	provider?: string,
-	flowOptions: { pkcePath?: string; additionalPkcePaths?: string[] } = {},
+	flowOptions: { pkcePath?: string; additionalPkcePaths?: string[]; maxAge?: number } = {},
 ): void {
 	const baseAttrs: CookieAttributes = {
 		path: '/',
 		httpOnly: true,
 		secure: true,
 		sameSite: 'lax',
-		maxAge: 600,
+		maxAge: flowOptions.maxAge ?? 600,
 	}
 	const pkcePaths = new Set([
 		flowOptions.pkcePath ?? options.callbackPath,

package/src/utils/issuer-fetch.ts

@@ -0,0 +1,20 @@
+import type { ResolvedAuthOptions } from '../options.js'
+import { getRuntimeEnv } from '../runtime.js'
+import type { IssuerFetch } from './tokens.js'
+
+/** Resolve lazily, retaining the binding receiver and never falling back on a bad binding. */
+export function resolveIssuerFetch(options: Pick<ResolvedAuthOptions, 'issuerFetch'>): IssuerFetch {
+	if (!options.issuerFetch) return fetch
+	return (input, init) => {
+		const binding = getRuntimeEnv()[options.issuerFetch!]
+		if (
+			typeof binding !== 'object' ||
+			binding === null ||
+			!('fetch' in binding) ||
+			typeof binding.fetch !== 'function'
+		) {
+			throw new Error('@growth-labs/auth: configured issuer service binding unavailable')
+		}
+		return binding.fetch(input, init)
+	}
+}

package/src/utils/issuer.ts

@@ -5,3 +5,14 @@ export function resolveInternalIssuer(
 ): string {
 	return options.issuerInternal ?? options.issuer
 }
+
+/** Redirect cookies and form return paths are untrusted input. */
+export function sameOriginRedirect(value: string | null | undefined, origin: string): string {
+	try {
+		const target = new URL(value || '/', origin)
+		if (target.origin === origin && !target.username && !target.password) return target.toString()
+	} catch {
+		/* use the local home page */
+	}
+	return new URL('/', origin).toString()
+}

package/src/utils/openauth.ts

@@ -6,6 +6,7 @@ import {
 	resolveClientSecret,
 } from './client-secret.js'
 import { resolveInternalIssuer } from './issuer.js'
+import { resolveIssuerFetch } from './issuer-fetch.js'
 import { generatePKCE } from './pkce.js'
 import { generateState } from './state.js'
 import { verifyIssuedAccessTokenClaims } from './tokens.js'
@@ -137,7 +138,7 @@ export async function exchangeCode(
 	})
 
 	try {
-		const response = await fetch(`${issuer}/token`, {
+		const response = await resolveIssuerFetch(options)(`${issuer}/token`, {
 			method: 'POST',
 			headers,
 			body: body.toString(),
@@ -148,7 +149,12 @@ export async function exchangeCode(
 		const data = await response.json()
 		if (!tokenResponseHasTokens(data)) return null
 
-		const claims = await verifyIssuedAccessTokenClaims(issuer, data.access_token, options.resource)
+		const claims = await verifyIssuedAccessTokenClaims(
+			options.issuerFetch ? options.issuer : issuer,
+			data.access_token,
+			options.resource,
+			{ jwksIssuer: issuer, jwksFetch: resolveIssuerFetch(options) },
+		)
 		if (!claims) return null
 
 		return {
@@ -181,7 +187,7 @@ export async function revokeToken(
 	}
 
 	try {
-		await fetch(`${issuer}/revoke`, {
+		await resolveIssuerFetch(options)(`${issuer}/revoke`, {
 			method: 'POST',
 			headers,
 			body: new URLSearchParams({

package/src/utils/tokens.ts

@@ -216,9 +216,10 @@ export async function verifyIssuedAccessTokenClaims(
 	issuer: string,
 	token: string,
 	audience: string | undefined,
+	options: Pick<VerifyAccessTokenOptions, 'jwksFetch' | 'jwksIssuer'> = {},
 ): Promise<TokenPayloadClaims | null> {
 	if (!audience) return null
-	const payload = await verifyAccessTokenPayload(issuer, token, { audience })
+	const payload = await verifyAccessTokenPayload(issuer, token, { audience, ...options })
 	if (!payload) return null
 	return extractTokenClaims(payload)
 }
@@ -298,6 +299,8 @@ async function exchangeRefreshToken(
 	clientId: string | undefined,
 	clientSecret: string | undefined,
 	resource: string,
+	fetcher: IssuerFetch,
+	verificationIssuer: string,
 ): Promise<RefreshExchange> {
 	try {
 		const params = new URLSearchParams({
@@ -314,7 +317,7 @@ async function exchangeRefreshToken(
 			headers.Authorization = createClientSecretBasicAuthHeader(clientId, clientSecret)
 		}
 
-		const response = await fetch(`${issuer}/token`, {
+		const response = await fetcher(`${issuer}/token`, {
 			method: 'POST',
 			headers,
 			body: params.toString(),
@@ -339,7 +342,12 @@ async function exchangeRefreshToken(
 			return { result: null, failure: { reason: 'malformed_response', status: response.status } }
 		}
 
-		const claims = await verifyIssuedAccessTokenClaims(issuer, data.access_token, resource)
+		const claims = await verifyIssuedAccessTokenClaims(
+			verificationIssuer,
+			data.access_token,
+			resource,
+			{ jwksIssuer: issuer, jwksFetch: fetcher },
+		)
 		if (!claims) {
 			return { result: null, failure: { reason: 'claims_rejected', status: response.status } }
 		}
@@ -367,6 +375,7 @@ export async function refreshTokens(
 	clientSecret?: string,
 	resource?: string,
 	onFailure?: (failure: RefreshFailure) => void,
+	transport: { issuerFetch?: IssuerFetch; verificationIssuer?: string } = {},
 ): Promise<TokenRefreshResult | null> {
 	// Reporting is advisory: a callback that throws must not change the outcome.
 	const report = (failure: RefreshFailure): void => {
@@ -382,7 +391,16 @@ export async function refreshTokens(
 	}
 	const exchange = await singleFlightRefresh(
 		['tokens', issuer, clientId ?? '', resource, refreshToken],
-		() => exchangeRefreshToken(issuer, refreshToken, clientId, clientSecret, resource),
+		() =>
+			exchangeRefreshToken(
+				issuer,
+				refreshToken,
+				clientId,
+				clientSecret,
+				resource,
+				transport.issuerFetch ?? fetch,
+				transport.verificationIssuer ?? issuer,
+			),
 	)
 	if (exchange.failure) report(exchange.failure)
 	return exchange.result

package/src/workers.ts

@@ -526,7 +526,12 @@ async function requestTokens(
 	}
 	let response: Response
 	try {
-		response = await config.issuerFetch(`${config.issuerInternal}/token`, {
+		// Detached call: `config.issuerFetch(...)` would invoke the default
+		// global fetch as a method of the config object, which Workers refuse
+		// with `TypeError: Illegal invocation` (0.17.0 regression for every
+		// consumer that leaves issuerFetch unset).
+		const issuerFetch = config.issuerFetch
+		response = await issuerFetch(`${config.issuerInternal}/token`, {
 			method: 'POST',
 			headers,
 			body: form.toString(),