@growth-labs/auth 0.9.1 → 0.10.2

package/src/utils/openauth.ts

@@ -1,10 +1,14 @@
 import { getConfig } from '../config-store.js'
 import type { TokenExchangeResult } from '../types.js'
-import { createClientSecretBasicAuthHeader, resolveClientSecret } from './client-secret.js'
+import {
+	type ClientSecretResolutionErrorCode,
+	createClientSecretBasicAuthHeader,
+	resolveClientSecret,
+} from './client-secret.js'
 import { resolveInternalIssuer } from './issuer.js'
 import { generatePKCE } from './pkce.js'
 import { generateState } from './state.js'
-import { decodeJwtPayload, extractTokenClaims } from './tokens.js'
+import { verifyIssuedAccessTokenClaims } from './tokens.js'
 
 export interface AuthFlow {
 	verifier: string
@@ -46,8 +50,8 @@ export async function getAuthorizationUrl(
 		code_challenge: flow.challenge,
 		code_challenge_method: 'S256',
 		provider,
+		resource: options.resource,
 	})
-	if (options.resource) params.set('resource', options.resource)
 
 	return {
 		url: `${options.issuer}/authorize?${params}`,
@@ -76,22 +80,52 @@ export function getResetPasswordUrl(): string {
 	return `${options.issuer}/reset-password`
 }
 
+function tokenResponseHasTokens(
+	data: unknown,
+): data is { access_token: string; refresh_token: string } {
+	if (typeof data !== 'object' || data === null) return false
+	return (
+		typeof (data as { access_token?: unknown }).access_token === 'string' &&
+		typeof (data as { refresh_token?: unknown }).refresh_token === 'string'
+	)
+}
+
+// Bounded sentinel returned when exchangeCode cannot resolve the client secret.
+// Callers check `'secretFailed' in result` to distinguish this from an
+// ordinary token-exchange failure (null) and route to a fail-closed 503
+// rather than a generic auth_failed redirect.
+export interface ExchangeSecretFailure {
+	readonly secretFailed: true
+	readonly code: ClientSecretResolutionErrorCode
+}
+
+// Backward-compatible exported sentinel for callers that only need a bounded
+// representative failure. Runtime exchangeCode results carry the actual code.
+export const EXCHANGE_SECRET_FAILURE: ExchangeSecretFailure = Object.freeze({
+	secretFailed: true,
+	code: 'BINDING_REJECTED',
+})
+
 export async function exchangeCode(
 	callbackUrl: URL,
 	code: string,
 	codeVerifier: string,
 	providerFromCookie?: TokenExchangeResult['provider'],
-): Promise<TokenExchangeResult | null> {
+	request?: Request,
+): Promise<TokenExchangeResult | ExchangeSecretFailure | null> {
 	const options = getConfig()
 	const issuer = resolveInternalIssuer(options)
 	const clientId = options.clientId || callbackUrl.hostname
 	const redirectUri = new URL(options.callbackPath, callbackUrl.origin).toString()
-	const clientSecret = await resolveClientSecret(options.clientSecret)
+	const secretResult = await resolveClientSecret(options.clientSecret, request)
+	if (!secretResult.ok) {
+		return Object.freeze({ secretFailed: true as const, code: secretResult.code })
+	}
 	const headers: Record<string, string> = {
 		'Content-Type': 'application/x-www-form-urlencoded',
 	}
-	if (clientSecret) {
-		headers.Authorization = createClientSecretBasicAuthHeader(clientId, clientSecret)
+	if (secretResult.secret) {
+		headers.Authorization = createClientSecretBasicAuthHeader(clientId, secretResult.secret)
 	}
 	const body = new URLSearchParams({
 		grant_type: 'authorization_code',
@@ -99,8 +133,8 @@ export async function exchangeCode(
 		code_verifier: codeVerifier,
 		redirect_uri: redirectUri,
 		client_id: clientId,
+		resource: options.resource,
 	})
-	if (options.resource) body.set('resource', options.resource)
 
 	try {
 		const response = await fetch(`${issuer}/token`, {
@@ -111,12 +145,11 @@ export async function exchangeCode(
 
 		if (!response.ok) return null
 
-		const data = (await response.json()) as {
-			access_token: string
-			refresh_token: string
-		}
+		const data = await response.json()
+		if (!tokenResponseHasTokens(data)) return null
 
-		const claims = extractTokenClaims(decodeJwtPayload(data.access_token))
+		const claims = await verifyIssuedAccessTokenClaims(issuer, data.access_token, options.resource)
+		if (!claims) return null
 
 		return {
 			accessToken: data.access_token,

package/src/utils/tokens.ts

@@ -105,11 +105,11 @@ export interface VerifyAccessTokenOptions {
 	algorithms?: string[]
 }
 
-export async function verifyAccessToken(
+async function verifyAccessTokenPayload(
 	issuer: string,
 	token: string,
 	options: VerifyAccessTokenOptions = {},
-): Promise<VerifiedClaims | null> {
+): Promise<Record<string, unknown> | null> {
 	try {
 		const header = decodeJwtHeader(token)
 		const kid = typeof header.kid === 'string' ? header.kid : undefined
@@ -122,15 +122,7 @@ export async function verifyAccessToken(
 		if (payload.mode !== 'access') {
 			throw new Error(`unexpected token mode: ${String(payload.mode)}`)
 		}
-		const claims = extractTokenClaims(payload as Record<string, unknown>)
-		return {
-			sub: claims.sub,
-			email: claims.email,
-			name: claims.name,
-			image: claims.image,
-			synthetic: payload.synthetic === true ? true : undefined,
-			purpose: typeof payload.purpose === 'string' ? payload.purpose : undefined,
-		}
+		return payload as Record<string, unknown>
 	} catch (err) {
 		if (!isExpiredJwtError(err)) {
 			console.error('verifyAccessToken error:', err)
@@ -139,6 +131,62 @@ export async function verifyAccessToken(
 	}
 }
 
+export async function verifyAccessToken(
+	issuer: string,
+	token: string,
+	options: VerifyAccessTokenOptions = {},
+): Promise<VerifiedClaims | null> {
+	const payload = await verifyAccessTokenPayload(issuer, token, options)
+	if (!payload) return null
+	const claims = extractTokenClaims(payload)
+	return {
+		sub: claims.sub,
+		email: claims.email,
+		name: claims.name,
+		image: claims.image,
+		synthetic: payload.synthetic === true ? true : undefined,
+		purpose: typeof payload.purpose === 'string' ? payload.purpose : undefined,
+	}
+}
+
+export async function verifyIssuedAccessTokenClaims(
+	issuer: string,
+	token: string,
+	audience: string | undefined,
+): Promise<TokenPayloadClaims | null> {
+	if (!audience) return null
+	const payload = await verifyAccessTokenPayload(issuer, token, { audience })
+	if (!payload) return null
+	return extractTokenClaims(payload)
+}
+
+function tokenResponseHasTokens(
+	data: unknown,
+): data is { access_token: string; refresh_token: string } {
+	if (typeof data !== 'object' || data === null) return false
+	return (
+		typeof (data as { access_token?: unknown }).access_token === 'string' &&
+		typeof (data as { refresh_token?: unknown }).refresh_token === 'string'
+	)
+}
+
+function tokenResultFromClaims(
+	accessToken: string,
+	refreshToken: string,
+	claims: TokenPayloadClaims,
+): TokenRefreshResult {
+	return {
+		accessToken,
+		refreshToken,
+		claims: {
+			sub: claims.sub,
+			email: claims.email,
+			name: claims.name,
+			image: claims.image,
+		},
+	}
+}
+
 export async function refreshTokens(
 	issuer: string,
 	refreshToken: string,
@@ -146,13 +194,14 @@ export async function refreshTokens(
 	clientSecret?: string,
 	resource?: string,
 ): Promise<TokenRefreshResult | null> {
+	if (!resource) return null
 	try {
 		const params = new URLSearchParams({
 			grant_type: 'refresh_token',
 			refresh_token: refreshToken,
 		})
 		if (clientId) params.set('client_id', clientId)
-		if (resource) params.set('resource', resource)
+		params.set('resource', resource)
 
 		const headers: Record<string, string> = {
 			'Content-Type': 'application/x-www-form-urlencoded',
@@ -169,23 +218,13 @@ export async function refreshTokens(
 
 		if (!response.ok) return null
 
-		const data = (await response.json()) as {
-			access_token: string
-			refresh_token: string
-		}
+		const data = await response.json()
+		if (!tokenResponseHasTokens(data)) return null
 
-		const claims = extractTokenClaims(decodeJwtPayload(data.access_token))
-
-		return {
-			accessToken: data.access_token,
-			refreshToken: data.refresh_token,
-			claims: {
-				sub: claims.sub,
-				email: claims.email,
-				name: claims.name,
-				image: claims.image,
-			},
-		}
+		const claims = await verifyIssuedAccessTokenClaims(issuer, data.access_token, resource)
+		if (!claims) return null
+
+		return tokenResultFromClaims(data.access_token, data.refresh_token, claims)
 	} catch {
 		return null
 	}